Phase 1 app: session list, session screen, spawn, QR enrollment over pinned TLS

Compose app mirroring local-updater's stack (single :androidApp module,
pinned CA, HttpURLConnection transport) plus what this app needs on top:
a bearer token sealed with an Android Keystore AES-GCM key, an
aiapp://enroll intent filter so scanning the server's terminal QR with
the stock camera enrolls the phone with no QR library, an SSE client
that resumes by transcript cursor, and a transcript renderer folding the
common event model into user bubbles, streaming text, collapsible tool
cards, and answerable question cards.

Verified on the tdep emulator against the real server: enrollment deep
link, list, spawn, streamed echo turn, question answer round trip, tool
card expansion, adjustResize keyboard behavior. Build is warning-clean
(compose.* accessors replaced with direct dependencies).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

app/androidApp/src/main/kotlin/com/example/aiapp/MainActivity.kt

@@ -0,0 +1,81 @@
+package com.example.aiapp
+
+import android.Manifest
+import android.content.Intent
+import android.os.Build
+import android.os.Bundle
+import android.widget.Toast
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.core.view.WindowCompat
+
+class MainActivity : ComponentActivity() {
+    // Bumped whenever enrollment lands via an aiapp:// intent so the
+    // composition below re-reads the stored settings.
+    private var settingsVersion by mutableStateOf(0)
+
+    // Registered up front since permission launchers must be registered
+    // before the activity reaches STARTED.
+    private val requestLocalNetworkPermission =
+        registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        // Transparent status bar on every version; the Surface below paints
+        // through underneath it and content insets itself. Same reasoning
+        // as local-updater's MainActivity.
+        enableEdgeToEdge()
+        WindowCompat.getInsetsController(window, window.decorView).isAppearanceLightStatusBars = true
+
+        // Android 17+ silently drops local-network traffic without this;
+        // requested up front because a denial is invisible at the socket
+        // layer (it just times out).
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.CINNAMON_BUN) {
+            requestLocalNetworkPermission.launch(Manifest.permission.ACCESS_LOCAL_NETWORK)
+        }
+
+        handleEnrollment(intent)
+
+        setContent {
+            MaterialTheme {
+                Surface(modifier = Modifier.fillMaxSize()) {
+                    Box(modifier = Modifier.fillMaxSize().statusBarsPadding().imePadding()) {
+                        AppRoot(settingsVersion)
+                    }
+                }
+            }
+        }
+    }
+
+    // launchMode="singleTop": an enrollment scan while the app is open
+    // lands here rather than in a second activity instance.
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        handleEnrollment(intent)
+    }
+
+    private fun handleEnrollment(intent: Intent?) {
+        val uri = intent?.data ?: return
+        val settings = parseEnrollmentUri(uri)
+        if (settings == null) {
+            Toast.makeText(this, "Not a valid enrollment code", Toast.LENGTH_LONG).show()
+            return
+        }
+        saveServerSettings(this, settings)
+        settingsVersion++
+        Toast.makeText(this, "Enrolled with ${settings.baseUrl}", Toast.LENGTH_LONG).show()
+    }
+}