fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

.gitea/workflows/android.yml

@@ -100,6 +100,7 @@ jobs:
             bash android/gradlew -p android connectedDebugAndroidTest
             python3 scripts/verify-test-results.py android/app/build/outputs/androidTest-results/connected/debug --minimum 6
             python3 scripts/test-integration.py "$YUVOMI_UPSTREAM" --android
+            python3 scripts/test-integration.py "$YUVOMI_UPSTREAM" --android --cookie-without-secure
       - uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
         if: always()
         with: