fix(android): bind dashboard auth to connection-owned routes

[trevornk]

Summary

Refs #565.

Keep an outgoing connection's stale resolver endpoint from becoming the Dashboard destination for an incoming connection's saved native credentials. Target: dev, base df0fe59b0b11b5b1646b62b9d2c23ef791194984.

Changes

• Accept a resolver endpoint only when it belongs to the selected connection's saved or synthesized routes; preserve authenticated-origin priority and existing fallback behavior.
• Resolve activeDashboardUrl() from the synchronous active ID/list instead of a lagging combined StateFlow.
• Add serialized multi-gateway persistence/refresh regressions, an outgoing-endpoint ownership regression, and explicit ownership in existing alternate-route fixtures.
• Add one Unreleased changelog entry. No diagnostics, branding, signing changes, dependency changes, or version bump.

Verification

Exact tested source tree: c5bea7b0b7b2157d3d8eb9cdeaf9706e9a961e85.

Fresh :app:testSideloadDebugUnitTest and :app:testGooglePlayDebugUnitTest runs each passed 79 tests, with zero failures, errors, or skips. Both used explicit --tests selectors for all six classes below; copied JUnit XML was independently checked for complete class membership and counts:

• com.hermesandroid.relay.viewmodel.MultiGatewayAuthPersistenceTest
• com.hermesandroid.relay.viewmodel.EffectiveDashboardRouteTest
• com.hermesandroid.relay.viewmodel.ConnectionSwitchTest
• com.hermesandroid.relay.viewmodel.connection.UpstreamTransportControllerRoutePoolTest
• com.hermesandroid.relay.network.upstream.NativeDashboardAuthTest
• com.hermesandroid.relay.network.upstream.NativeDashboardSignInCoordinatorTest

The successful flavor runs used separate Gradle JVMs with --max-workers=1, a 3 GiB heap, and in-process Kotlin. An earlier combined-flavor attempt was stopped at the memory bound before producing test results; it is not counted as a pass.

Passed: git diff --check, exact patch/tree verification, independent correctness/security review, full public-payload privacy review, and all five repository checks:

• python scripts/check-android-locales.py
• python scripts/check-user-docs-locales.py
• python scripts/check-android-collection-apis.py
• python scripts/check-android-release-notes.py
• python scripts/check-version-tracks.py

Both Android lint tasks (:app:lintGooglePlayDebug and :app:lintSideloadDebug) completed successfully on the same source tree. Required upstream CI remains separate from these local results and must be checked before integration.

Not certified by these tests: Android Keystore, browser callback/PKCE handling, OS process death, rendered lifecycle behavior, or physical-device behavior of this exact pruned export. The persistence fixture uses production serialization and real loopback HTTP with a file-backed substitute for the raw secure-store backend. No emulator, instrumentation, current-upstream conformance, or full Android suite is claimed.

Screenshots

No visual change. No screenshots or private operational evidence are attached.

Compatibility / risk

The standard Dashboard/Gateway path remains upstream-owned and needs no Relay plugin or server patch. TLS policy, connection/origin credential fences, token schema, cookie scope, PKCE/state/callback ownership, refresh rotation, revocation, and explicit sign-out are unchanged. Already-erased or revoked credentials still require legitimate sign-in.

Related #513, #515, and #541 concern separate scopes; this PR does not claim to resolve them. Open #559 also touches ConnectionViewModel.kt for hosted rooms, so integration should be rechecked before merging.

Lineage / contributor credit

• Source PR(s): N/A; independent local fix, not salvage/replacement work.
• Attribution preserved by: no existing contributor commits are rewritten; privacy-safe GitHub noreply metadata is used for this contribution.

Checklist

• Target branch is dev.
• Scope is focused and related issues/PRs are linked.
• Android lint completed; focused tests passed as detailed above.
• Translation changes: N/A; locale validation also passed.
• Server/plugin changes: N/A.
• Desktop changes: N/A.
• Docs/site changes: changelog only; no site code changed.
• No visual change; missing exact-export device/lifecycle proof is stated.
• Commit message follows Conventional Commits.
• CHANGELOG.md contains the user-visible fix.
• Public writing hygiene reviewed; no secrets or private infrastructure are attached.
• Salvaged/replacement work: N/A.

[hermes-relay-triage]

🤖 Hermes-Relay automated PR intake

Thanks for the focused Android fix and thorough intake details! The PR targets dev, links #565 and related work, completes every template section and checklist item, states that there is no visual change, and includes focused test and lint results.

One item needs reconciliation before review: the Verification section identifies c5bea7b0b7b2157d3d8eb9cdeaf9706e9a961e85 as the exact tested source tree, while the current PR head is c1413c494fccfc2c52bf468de3a95aa347b5fa39. Please confirm that the tested tree is equivalent or provide exact commands and results for the current head.

A maintainer will review the implementation and current CI once that verification provenance is clear.