fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

docs/build-android.md

@@ -62,6 +62,7 @@ git clone --filter=blob:none https://github.com/ulsklyc/yuvomi.git /path/to/upst
 git -C /path/to/upstream checkout 10bfef7686ed7303b4c74c7fcc55a5eb16356c9d
 npm ci --omit=dev --prefix /path/to/upstream
 python3 scripts/test-integration.py /path/to/upstream --android
+python3 scripts/test-integration.py /path/to/upstream --android --cookie-without-secure
 ```
 
 Requires Node 22.14+ and a running emulator. The harness creates and removes its
@@ -71,6 +72,11 @@ Keep test reports private if you customize the harness with real data (not advis
 The native test calls the real API through native controls and saves a synthetic
 dashboard screenshot under `app/build/outputs/native-screenshots/`. It does not
 demonstrate native SSO merely because the protocol fixture also tests OIDC.
+Both commands retain HTTPS and system/test-CA validation; the second reproduces
+upstream's default `SESSION_SECURE=false` cookie attributes behind an HTTPS proxy.
+The native jar must retain that session while continuing to forbid HTTP and
+cross-origin replay. The scenario also rejects a wrong password, then retries
+successfully without retaining the old error.
 The test writes through `PlatformTestStorageRegistry`; AGP collects the file in
 `outputs/connected_android_test_additional_output/integrationAndroidTest/` before
 uninstalling the fixture. The harness rejects missing/ambiguous output and removes