fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+### Android 0.2.1 native preview (code 3)
+
+- Fix login against upstream-default session cookies without `Secure`: Android
+  now retains them in its origin-bound HTTPS-only jar instead of losing the
+  authenticated session. HTTP, cross-origin redirects and invalid TLS remain denied.
+- Distinguish credential/code rejection from a missing/rejected native session;
+  clear a previous login error after a successful retry.
+- Exercise both upstream cookie configurations over real HTTPS, including a wrong
+  password followed by a successful native login. See `docs/login-troubleshooting.md`.
+
+### Initial native preview
+
 - Begin the genuine native rebuild: Compose/SwiftUI screens, direct HTTPS API,
   protected native session storage and initial auth/dashboard/task/note/shopping
   flows. Archive the rejected WebView renderer and its tests. Full PWA parity is
@@ -10,6 +22,8 @@
 - Gitea workflows for the maintainer's Ubuntu pool and native M4 Pro runner,
   explicit SDK/KVM prerequisites, SHA-256 checkout and unsigned-only CI release builds.
 
+### Archived browser prototype (not shipped)
+
 - Native Android HTTPS onboarding, origin-bound browsing, session persistence,
   recovery, server erasure, camera/document selection, downloads and blob exports.
 - SwiftUI/WKWebView iOS implementation, isolated web sign-in, native settings,