Mobile auth: AndroidX Auth Tab, secure token storage, session restore #22

Part of #14 (W3 — mobile v1). The secure transport is implemented in #65 with client registration tracked in #47.

Outcome

A user signs into the mobile flavor with their put.io account through AndroidX Auth Tab, stays signed in across restarts, and can sign out. Auth gates every account-backed mobile slice.

Scope

• OAuth sign-in through AndroidX Auth Tab with exact redirect putio://auth
• Require and pin the Auth Tab-capable default browser; never fall back to ordinary Custom Tabs
• Export no callback Activity or custom-scheme manifest filter
• Validate the exact callback endpoint and pending state before accepting a bounded token
• Store the token in app-owned, Keystore-backed encrypted storage; never plaintext SharedPreferences or DataStore
• Restore and validate the session on launch
• Distinguish API rejection from transport failure: rejection clears the token, transport failure keeps it and offers retry
• Sign-out clears secure storage, pending auth state, account state, and SDK token state
• Show loading, failure, retry, cancellation, and secure-storage-unavailable states from the shared contract

Acceptance criteria

• Sign in, kill the app, and relaunch into the authenticated Files surface
• A revoked token returns to sign-in with a clear message
• Cancellation returns quietly to signed out
• Malformed, mismatched, duplicate, expired, or unsolicited callbacks store nothing and consume the pending attempt
• ./gradlew verify and both production-debug assembles pass
• The full registered OAuth round trip is evidenced on the local harness and attached to the implementation PR

Proof

API 37 Google APIs with Chrome 145.0.7632.218 completed the registered OAuth round trip. Real root Files loaded; force-stop/relaunch restored the encrypted session; nested Files loaded; sign-out returned to the signed-out state. The rejected-token, cancellation, and malformed-callback contracts remain covered by the green automated suite. Post-auth captures are attached to #65; credential and callback surfaces were intentionally not captured.

Implementation: #65. Shared contract: putio-frontend#34.