fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

android/app/src/androidTestNativeIntegration/java/community/yuvomi/mobile/NativeUpstreamTest.kt

@@ -77,9 +77,16 @@ class NativeUpstreamTest {
         compose.onNodeWithTag("connect").performClick()
         awaitTag("username")
         compose.onNodeWithTag("username").performTextInput("mobiletest")
+        compose.onNodeWithTag("password").performTextInput(password + "-invalid")
+        compose.onNodeWithTag("login").performScrollTo().performClick()
+        awaitTag("auth-error")
+        compose.onNodeWithText("Benutzername oder Passwort wurden vom Server nicht akzeptiert.").assertIsDisplayed()
         compose.onNodeWithTag("password").performTextInput(password)
         compose.onNodeWithTag("login").performScrollTo().performClick()
         awaitTag("native-dashboard")
+        compose.activityRule.scenario.onActivity {
+            assertEquals(null, ViewModelProvider(it)[NativeController::class.java].state.error)
+        }
         captureFixtureDashboard()
         compose.activityRule.scenario.moveToState(Lifecycle.State.CREATED)
         compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)