feat(android): access-token support — same frozen contract as iOS

Android could not connect at all once the server set WEBTERM_TOKEN. Hand-written
Cookie header on every request and on the WS upgrade (no CookieJar, matching the
frozen decision), POST /auth pairing probe, Keystore-backed storage, and a 401
upgrade as a terminal state with no reconnect loop.

android/host-registry/build.gradle.kts

@@ -45,6 +45,10 @@ dependencies {
     implementation(libs.kotlinx.serialization.json)
     implementation(libs.kotlinx.coroutines.core)
     implementation(libs.androidx.datastore.preferences)
+    // Tink AEAD encrypts the per-host access-token blob at rest under an AndroidKeystore-wrapped
+    // master key (B5 / ios-completion §1.1). A SEPARATE keyset from :client-tls-android's cert store —
+    // different secrets, different lifecycles, and no module edge to the TLS half.
+    implementation(libs.tink.android)
 
     testImplementation(libs.bundles.unit.test)
     testRuntimeOnly(libs.junit.platform.launcher)