fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

docs/continuation.md

@@ -13,6 +13,18 @@ Read [native parity](native-parity.md), [architecture](architecture.md), and
 shopping slices exist, but **no module has accepted full visual/functional parity**.
 The remaining pages/settings/auth/file/offline/notification work is explicit.
 
+### Android login follow-up: 0.2.1 native preview / code 3
+
+A user reported immediate HTTP-401 login failure although the same direct password
+login works in the browser. Reproduced against unmodified upstream by setting its
+existing `SESSION_SECURE=false` default behind the HTTPS fixture: the old Android
+jar discarded the cookie and the next authenticated request failed. The fix keeps
+all native cookies HTTPS/origin-bound independent of that server attribute;
+certificate checks, redirect refusal, encryption and expiry are unchanged. Login
+errors now distinguish credential/code rejection from session-cookie problems and
+a successful retry clears the old error. Both secure/default-cookie test modes
+are in CI; see `login-troubleshooting.md` and the latest validation section.
+
 The owner-authorized signing key and four Gitea secrets were created before this
 correction. Their private backup is `/home/neste/yuvomi-signing/initial-20261021`.
 Do not print its contents. Uncommitted signing changes are preserved in Git stash
@@ -34,7 +46,7 @@ is not typechecked by Linux. Gitea's Mac job now bootstraps pinned Node before
 checkout, but actual Xcode results still need inspection. Ubuntu emulator jobs
 continue requiring accessible KVM; do not weaken or fake that evidence.
 
-Latest local native evidence: 10 JVM tests, 6 API-35 Compose tests, 7 real-server
+Initial 0.2.0 local native evidence: 10 JVM tests, 6 API-35 Compose tests, 7 real-server
 instrumentation tests (including those same 6), both lint variants and native
 debug/unsigned release APK/AAB builds pass. Sixteen portable Swift tests and strict
 format/parsing pass. Screenshot export now uses AndroidX test storage/AGP output