feat(android): implement secure self-hosted companion and release builds

Add native HTTPS onboarding, origin-bound WebView, isolated web authentication, persistent sessions, upload/camera picker, bounded authenticated downloads and recovery. Validate JVM policy tests, debug APK, lint and unsigned release APK/AAB. Build outputs can be relocated for WSL.

android/build.gradle.kts

@@ -0,0 +1,13 @@
+plugins {
+    id("com.android.application") version "8.13.2" apply false
+    id("org.jetbrains.kotlin.android") version "2.2.10" apply false
+}
+
+// WSL mounted Windows volumes may reject Gradle's POSIX file metadata operations.
+// Opt-in external output root; ordinary developer/CI builds retain standard paths.
+val outputRoot = providers.environmentVariable("YUVOMI_BUILD_DIR")
+if (outputRoot.isPresent) {
+    allprojects {
+        layout.buildDirectory.set(file("${outputRoot.get()}/${project.name}"))
+    }
+}