feat(android): pure-Kotlin foundation — AW0 scaffold + AW1 modules (218 tests green)

Implements the verifiable pure-Kotlin core of the Android client per
docs/ANDROID_CLIENT_PLAN.md, mirroring the iOS SPM package set as Gradle modules.
Built + reviewed via multi-agent workflow (explore→implement→verify→review),
then review findings fixed with regression tests.

Modules (all pure JVM, kotlin("jvm"); Android-framework modules scaffolded but
gated off in settings — no Android SDK in this env):
- :wire-protocol  — frozen wire contract (sealed Client/ServerMessage, enums,
  HostEndpoint CSWSH origin derivation, transport interfaces), hand-rolled codec
  byte-identical to the server's JSON.stringify + tolerant kotlinx decode.
- :session-core   — ReconnectMachine (1→2→4→8→16→30 backoff), PingScheduler,
  GateTracker (two-line epoch guard), AwayDigest, UnreadLedger, TitleSanitizer,
  KeyByteMap (byte-matches public/keybar.ts).
- :api-client     — all REST routes, tolerant decode, Origin-iff-guarded, prefs
  unknown-key preservation, pairing probe + host-tier classifier.
- :client-tls     — pure half: PKCS#12 parse, X509KeyManager alias logic,
  CertificateSummary, provider-agnostic wrong-passphrase classification.
- :test-support   — FakeTransport / FakeHttpTransport / virtual-clock fakes.

Verify: ./gradlew clean test → 218 tests, 0 failures (wire-protocol 47,
session-core 60, api-client 69, client-tls 27, test-support 15).

Review (3 lenses, 8/10 each) findings fixed: sessionId JSON-injection escape,
CancellationException propagation in PingScheduler, PairingProbe close-on-cancel
leak, HostEndpoint trim, HostClassifier hoisted to :wire-protocol (type unified),
BouncyCastle-portable wrong-passphrase detection, lone-surrogate escaping.

Known gap (documented, deferred): /push/fcm-token has no server route yet —
plan task A33 (src/push/fcm.ts) delivers it.

android/host-registry/build.gradle.kts

@@ -0,0 +1,33 @@
+// ─────────────────────────────────────────────────────────────────────────────
+// :host-registry — Host / HostStore + DataStore-backed storage, LastSessionStore.
+// Mirrors the iOS HostRegistry package (storage behind an interface).
+//
+// NOTE: the plan (§3) treats the storage half as Android-framework-bound (DataStore),
+// so it is scaffolded here as an SDK-gated module. Its pure logic could later be
+// split into a JVM module if the Kover gate needs it; for now it is COMMENTED OUT
+// in settings.gradle.kts (no Android SDK here).
+//
+// SCAFFOLD STUB ONLY. TODO(android-sdk): enable when an Android SDK is available.
+// ─────────────────────────────────────────────────────────────────────────────
+
+/*
+plugins {
+    id("com.android.library")
+    alias(libs.plugins.kotlin.android)
+    alias(libs.plugins.kotlin.serialization)
+}
+
+android {
+    namespace = "wang.yaojia.webterm.hostregistry"
+    compileSdk = 35
+    defaultConfig { minSdk = 29 }
+}
+
+kotlin { jvmToolchain(17) }
+
+dependencies {
+    implementation(project(":wire-protocol"))
+    // implementation("androidx.datastore:datastore-preferences:1.1.1")
+    // implementation("androidx.datastore:datastore:1.1.1")
+}
+*/