feat(android): replace WebView with tested native Compose API slice

Add real native onboarding/auth/dashboard/tasks/notes/shopping, origin-bound HTTPS and encrypted AndroidKeyStore session persistence. Archive the superseded browser renderer and tests. Verify 10 JVM tests, 6 native API-35 emulator tests, lintDebug/lintRelease and debug/unsigned release APK/AAB builds; the real upstream suite passes 7 tests and exports a nonblank native fixture screenshot. Tink host-tool update removes the old generated-protobuf warning. Full module/visual parity remains explicitly incomplete.

android/build.gradle.kts

@@ -11,6 +11,7 @@ buildscript {
             when (requested.group) {
                 "io.netty" -> useVersion("4.1.139.Final")
                 "com.google.protobuf" -> useVersion("3.25.9")
+                "com.google.crypto.tink" -> useVersion("1.15.0")
                 "org.bouncycastle" -> useVersion("1.86")
                 "org.apache.commons" -> if (requested.name == "commons-lang3") useVersion("3.21.0")
                 "org.apache.httpcomponents" -> if (requested.name == "httpclient") useVersion("4.5.14")
@@ -21,7 +22,10 @@ buildscript {
     }
 }
 
-plugins { id("com.android.application") version "9.4.1" apply false }
+plugins {
+    id("com.android.application") version "9.4.1" apply false
+    id("org.jetbrains.kotlin.plugin.compose") version "2.4.21" apply false
+}
 
 // WSL mounted Windows volumes may reject Gradle's POSIX file metadata operations.
 // Opt-in external output root; ordinary developer/CI builds retain standard paths.