fix(android): harden origin isolation and native file lifecycles

Block cross-origin POSTs, preserve bounded generated exports without relaxing CSP, bind picker results to their initiating context, erase camera cache and constrain platform permissions. Upgrade vulnerable build/test tooling and lock runtime/build dependencies. JVM regressions, lint and unsigned release builds pass; extended emulator validation remains separate.

android/app/build.gradle.kts

@@ -1,15 +1,14 @@
 plugins {
     id("com.android.application")
-    id("org.jetbrains.kotlin.android")
 }
 
 android {
     namespace = "community.yuvomi.mobile"
-    compileSdk = 36
+    compileSdk { version = release(37) { minorApiLevel = 0 } }
     defaultConfig {
         applicationId = "community.yuvomi.mobile"
         minSdk = 26
-        targetSdk = 36
+        targetSdk = 37
         versionCode = 1
         versionName = "0.1.0"
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
@@ -18,19 +17,75 @@ android {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
-            proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            proguardFiles(
+                getDefaultProguardFile("proguard-android-optimize.txt"),
+                "proguard-rules.pro",
+            )
             // Signing is deliberately supplied by the authorized release maintainer.
         }
+        create("integration") {
+            initWith(getByName("debug"))
+            applicationIdSuffix = ".integration"
+            matchingFallbacks += "debug"
+        }
     }
     compileOptions {
         sourceCompatibility = JavaVersion.VERSION_17
         targetCompatibility = JavaVersion.VERSION_17
     }
-    lint { abortOnError = true; warningsAsErrors = true }
+    lint {
+        abortOnError = true
+        warningsAsErrors = true
+    }
+    if (providers.gradleProperty("integration").isPresent) {
+        testBuildType = "integration"
+        sourceSets.getByName(
+            "androidTest",
+        ).kotlin.directories.add("src/androidTestIntegration/java")
+        val testResources = providers.environmentVariable("YUVOMI_TEST_RES").get()
+        sourceSets.getByName("integration").res.directories.add(testResources)
+        defaultConfig.testInstrumentationRunnerArguments["server"] =
+            providers.environmentVariable("YUVOMI_TEST_URL").get()
+        defaultConfig.testInstrumentationRunnerArguments["password"] =
+            providers.environmentVariable("YUVOMI_TEST_PASSWORD").get()
+    }
 }
 
 kotlin { compilerOptions { jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17) } }
 
+dependencyLocking { lockAllConfigurations() }
+
+// AGP's device-test tools still request vulnerable older wire libraries. These
+// are host-only, not APK dependencies; stay within binary-compatible minor lines.
+configurations.configureEach {
+    if (name.startsWith("_internal-unified-test-platform") || name == "androidLintTool" ||
+        name == "unified-test-platform-gradle-work-action"
+    ) {
+        resolutionStrategy.eachDependency {
+            when (requested.group) {
+                "io.netty" -> {
+                    useVersion("4.1.139.Final")
+                    because("Remediate published host-test HTTP/TLS advisories")
+                }
+                "com.google.protobuf" -> {
+                    useVersion("3.25.9")
+                    because("Remediate protobuf recursion/DoS advisories")
+                }
+                "org.bouncycastle" -> {
+                    useVersion("1.86")
+                    because("Remediate published build-tool cryptography advisories")
+                }
+                "org.apache.commons" -> if (requested.name == "commons-lang3") useVersion("3.21.0")
+                "org.apache.httpcomponents" -> if (requested.name ==
+                    "httpclient"
+                ) {
+                    useVersion("4.5.14")
+                }
+            }
+        }
+    }
+}
+
 dependencies {
     implementation("androidx.activity:activity-ktx:1.10.1")
     implementation("androidx.core:core-ktx:1.16.0")