fix(android): retain HTTPS sessions with upstream default cookie flags

Reproduce browser-success/native-401 with unmodified upstream SESSION_SECURE=false behind HTTPS. Keep cookies in the existing HTTPS-only origin-bound encrypted jar regardless of the server Secure attribute; preserve TLS, redirect, expiry and origin protections. Distinguish credential/2FA rejection from missing/rejected session handoff and clear stale login errors on retry. Verify 13 JVM tests plus the 7-test real-server suite in both Secure/default-cookie modes, including bad-password then successful native login. Bump Android preview to 0.2.1/code 3; extend CI and document the defect without claiming access to the user's production server.

scripts/integration-server.mjs

@@ -13,7 +13,10 @@ process.env.PORT = '0';
 process.env.BIND_ADDRESS = '127.0.0.1';
 process.env.DB_PATH = path.join(directory, 'fixture.db');
 process.env.SESSION_SECRET = randomBytes(48).toString('hex');
-process.env.SESSION_SECURE = 'true';
+// Exercise both explicit Secure cookies and upstream's default behind HTTPS.
+const sessionSecure = process.env.YUVOMI_TEST_SESSION_SECURE ?? 'true';
+if (!['true', 'false'].includes(sessionSecure)) throw new Error('Invalid fixture cookie mode');
+process.env.SESSION_SECURE = sessionSecure;
 process.env.DB_ENCRYPTION_KEY = '';
 process.env.NODE_ENV = 'test';
 process.env.LOG_LEVEL = 'warn';