feat(android): native Android client — full app parity build (A1–A36 + S1)

Mirror the iOS P0+P1 client as a Gradle multi-module app. Pure-JVM (Kover ≥80% gated):
:wire-protocol (frozen contract + HostEndpoint CSWSH origin + byte-exact codec),
:session-core (SessionEngine + reconnect/ping/gate/digest reducers), :api-client,
:client-tls (pure PKCS12/keymanager), :transport-okhttp (OkHttp WS+REST). Framework:
:app (Compose M3 Adaptive, Hilt, FCM, 11 screens + NavGraph), :terminal-view (Termux
terminal-emulator/-view via JitPack, Apache-2.0 — the renderer seam proven headless),
:host-registry (DataStore), :client-tls-android (AndroidKeyStore + Tink).

Highlights: single-key-home mTLS (non-exportable AndroidKeyStore key + re-reading
X509KeyManager + connectionPool.evictAll on rotation, ping-pong single-commit so a failed
rotation never clobbers the prior identity); FCM Allow/Deny trust split (Deny=BroadcastReceiver,
Allow=trampoline Activity hosting BiometricPrompt); per-consumer-Channel EventBus (R10);
config-surviving RetainedSessionHolder; byte-exact KeyByteMap; §5.4 pairing warning tiers.

Verified: ~484 JVM tests + Kover ≥80% on the pure modules + :app assembles to an APK; all
framework modules assemble. Device behaviors (rendering/IME/FCM/biometric/camera, E2E A34/A35,
S2 real-handset FCM spike) deferred to android/DEVICE_QA_CHECKLIST.md per plan §7 (no
emulator/Firebase here). Built via multi-agent orchestration (TDD builders → adversarial
cross-review → fix → re-verify → independent gate); progress in android/PROGRESS_ANDROID.md.

android/settings.gradle.kts

@@ -15,6 +15,10 @@ dependencyResolutionManagement {
     repositories {
         google()
         mavenCentral()
+        // JitPack — builds the Apache-2.0 Termux terminal-emulator + terminal-view
+        // submodules on demand for :terminal-view (A16, plan §9 R2). Scoped to those
+        // two libs only; never termux-shared/app (GPLv3).
+        maven { url = uri("https://jitpack.io") }
     }
     // The version catalog at gradle/libs.versions.toml is auto-registered as `libs`.
 }
@@ -28,16 +32,22 @@ include(":session-core")
 include(":api-client")
 include(":client-tls")
 include(":test-support")
+// :transport-okhttp (A7) — OkHttp is a plain JVM lib, so this pure-JVM module
+// builds and tests here (MockWebServer) with NO Android SDK.
+include(":transport-okhttp")
 
 // ── Android-framework modules ───────────────────────────────────────────────────
 // The Android SDK IS now installed (see android/README.md → "Android SDK setup"),
-// and AGP 9.2.1 is proven to build against SDK 35 with Gradle 9.6.1. These stay
-// commented out only because their build.gradle.kts are still empty SCAFFOLD STUBS
-// — enable each as its real module is implemented (plan AW2+).
+// and AGP 9.2.1 is proven to build against SDK 35 with Gradle 9.6.1. Enable each as
+// its real module is implemented (plan AW2+).
 // Recipe: apply `alias(libs.plugins.android.library)` ONLY (AGP 9 has built-in
-// Kotlin — do NOT add kotlin.android); android { namespace; compileSdk = 35;
+// Kotlin — do NOT add kotlin.android); android { namespace; compileSdk = 36;
 // defaultConfig { minSdk = 29 } }.
-// include(":app")               // AW4 — uses libs.plugins.android.application
-// include(":terminal-view")     // AW3
-// include(":host-registry")     // AW1/AW2 storage half
-// include(":client-tls-android") // AW1 framework half
+//
+// :app (A13) — the Android application: Compose Material 3 (+ Adaptive) design
+// system, Hilt DI skeleton, launcher MainActivity. This module establishes the
+// Android UI-stack version matrix for every later Android task.
+include(":app")                  // A13 — libs.plugins.android.application + compose + ksp + hilt
+include(":terminal-view")        // A16 — android-library + Termux terminal-emulator/-view (JitPack, Apache-2.0)
+include(":host-registry")        // A12 — android-library + DataStore (Host list / last-session)
+include(":client-tls-android")   // A11 — android-library + AndroidKeyStore import + Tink AEAD