test: exercise native Android flows against pinned upstream HTTPS and OIDC

Add an ephemeral HTTPS proxy and standards-shaped RS256/S256-PKCE test IdP around the unmodified upstream checkout. Require unlocked devices and nonempty, failure-free JUnit evidence. The extended API 35 suite passes all seven cases, including native Blob/file transfer, session recreation, outage recovery, isolated OIDC and back navigation; eight evidence-verifier regressions also pass. API 37 and real-provider/device validation remain release gates.

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 .idea/
 .gradle/
+.kotlin/
 **/build/
 local.properties
 *.keystore