fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

docs/architecture.md

@@ -8,7 +8,7 @@ window around that website. Both shipping entry points now render native views:
 | Screens and navigation | Jetpack Compose / Material 3 primitives, Yuvomi tokens | SwiftUI, Yuvomi tokens |
 | Application state | AndroidViewModel + Compose state | MainActor ObservableObject |
 | JSON API | HttpsURLConnection, serialized worker | URLSession actor, bounded streaming delegate |
-| Session ownership | Explicit origin-bound secure-cookie jar | Private ephemeral URLSession cookie storage |
+| Session ownership | Explicit origin-bound HTTPS-only cookie jar | Private ephemeral URLSession cookie storage |
 | Persistent cookies | AES-GCM, AndroidKeyStore key, origin as authenticated data | Keychain, WhenUnlockedThisDeviceOnly, origin-scoped account |
 | Server logic | Existing unmodified Yuvomi API | Existing unmodified Yuvomi API |
 
@@ -34,6 +34,11 @@ navigation destinations. The other modules remain unfinished.
   Session-only cookies are not converted to long-lived cookies.
 - Native UI mutations wait for the server result. Permissions remain enforced
   server-side; sparse module/widget permissions also control native affordances.
+- Android's native jar enforces HTTPS itself rather than rejecting a valid server
+  cookie solely because its `Secure` attribute is absent. This supports upstream's
+  default session settings behind HTTPS proxies without permitting HTTP or
+  cross-origin cookie replay. Browser cookie configuration remains the server
+  operator's responsibility; `SESSION_SECURE=true` is recommended for HTTPS sites.
 - Local removal clears the native cookie vault and in-memory records. It is not
   remote revocation. Logout attempts server revocation and still erases the local
   session if the server cannot be reached.