fix(ios,android): close the acceptance gaps the review found, add Android CI

- T-iOS-34's stated acceptance is "最大字号不破版" and it was failing: the key bar
  froze its height at 52pt while an AX5 keycap needs 108.24pt, so caps clipped —
  recorded as a withKnownIssue rather than fixed. Height now derives from the
  content size category (and tracks live changes via registerForTraitChanges);
  the known-issue marker is gone, replaced by positive assertions including a
  12-category no-clip sweep and a guard that stays red if anyone writes the
  constant back. Honest tradeoff: the keycap font is clamped at .accessibility2,
  the same policy the design system already applies to dense content, because an
  unclamped AX5 bar would eat the terminal. A test pins the clamp so the two
  cannot drift.

- Thumbnails silently 401'd on a token-gated host: the pipeline built its own
  transport with no token source, and by design never throws, so every preview
  degraded to a placeholder with no signal. Assembled from AppEnvironment now.

- Android had zero CI while the token wave shipped 24 files of secret-handling
  code. The instrumented leg is workflow_dispatch-only and says why in the file:
  no one has ever seen it green on a runner, and a required leg nobody trusts
  just produces a false green.

- Android persisted a validated token before the host probe succeeded, stranding
  a secret for a host that never paired.

App bundle 534 -> 550 on both simulators, zero known issues. Android 687 -> 691.

ios/App/WebTerm/Components/SessionThumbnail.swift

@@ -1,5 +1,4 @@
 import APIClient
-import ClientTLS
 import Foundation
 import os
 import SwiftUI
@@ -226,19 +225,25 @@ final class SessionThumbnailPipeline {
         cache = SessionThumbnailCache(maxEntries: maxCacheEntries)
     }
 
-    /// 生产装配：ephemeral URLSession（preview 字节可能含屏上密钥，内存缓存
-    /// only——同 T-iOS-19 对 RO GET 的裁定），并携带 C-iOS-2 的设备证书身份，
-    /// 这样对隧道主机的预览取数也能通过 mTLS（否则缩略图会被 nginx 拒握手）。
-    /// 身份经 provider 每次握手时按需从 keychain 载入（MEDIUM 无需重启修复：
-    /// 中途导入的证书下次取数即生效；缺证=nil，对本地主机无副作用）。
-    static func live() -> SessionThumbnailPipeline {
-        let identityStore = KeychainClientIdentityStore()
-        let transport = URLSessionHTTPTransport(identityProvider: {
-            identityStore.loadedIdentityOrNil()
-        })
-        return SessionThumbnailPipeline(
+    /// 生产装配：取数走**组合根装配**的那条带凭证的传输
+    /// （`AppEnvironment.thumbnailTransport()`）—— ephemeral URLSession（preview
+    /// 字节可能含屏上密钥，内存缓存 only，同 T-iOS-19 对 RO GET 的裁定）
+    /// + C-iOS-2 的设备证书身份（否则隧道主机的缩略图会被 nginx 拒握手）
+    /// + **C1 每主机访问令牌 Cookie**。两个凭证都按请求/按握手现取，
+    /// 中途导入的证书、中途输入的令牌下一次取数即生效，无需重启。
+    ///
+    /// F1（本次修复）：这里原先自建一个**没有令牌源**的传输，于是在开了
+    /// `WEBTERM_TOKEN` 的主机上 `GET /live-sessions/:id/preview` 一律 401；
+    /// 而本管线按设计永不抛错（失败即占位图），401 就被静默降级成
+    /// **每一张**缩略图都是占位符，屏幕上没有任何原因可查。
+    ///
+    /// - Parameter http: 取数传输。默认即上述生产装配；测试注入替身。
+    static func live(
+        http: any HTTPTransport = AppEnvironment.thumbnailTransport()
+    ) -> SessionThumbnailPipeline {
+        SessionThumbnailPipeline(
             loader: { request in
-                try await APIClient(endpoint: request.endpoint, http: transport)
+                try await APIClient(endpoint: request.endpoint, http: http)
                     .preview(id: request.sessionId)
             },
             renderer: { data, cols, rows in