Problem: Android WebView opens OAuth in external browser (Chrome).
After successful login, cookie stays in Chrome and WebView remains
unauthenticated because cookies are not shared between apps.

Solution: bridge page flow that avoids cookies entirely for mobile.

Backend:
- /auth/login accepts ?platform=android and ?return_to params
- /auth/callback detects android via state metadata, skips cookie,
  redirects to /auth/mobile-done?sid=<session_id>
- /auth/mobile-done renders HTML that deep-links to navi://auth/callback

Webclient:
- login() detects NaviAndroid UA and adds ?platform=android

Android:
- MainActivity: handle incoming navi:// intent in onCreate and onNewIntent,
  set cookie via CookieManager, reload WebView
- AndroidManifest: add intent-filter for navi://auth/callback and
  singleTask launchMode

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Thin Android shell that loads the Navi web interface from a configured
server URL. All UI served from the server — no local assets, no rebuild
needed for interface updates.

Features:
- First-launch setup screen to enter server URL (stored in SharedPreferences)
- On connection error: clears saved URL so next launch re-asks
- Full-screen WebView, no toolbar
- Camera + gallery + file picker via WebChromeClient.onShowFileChooser
- HTTP cleartext enabled for local network access
- targetSdk 34 to avoid forced edge-to-edge on Android 15
- Adaptive icon: logo SVG converted to Android vector drawable

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>