fix(android): retain browser sign-in callback in foreground

[Codename-11]

Summary

• Keep user-started Dashboard browser sign-in in a bounded foreground service through callback, token exchange, and session verification.
• Show the selected provider on escaped callback pages and document the Play special-use declaration.

Verification

• 33 focused unit tests passed across service lifecycle, callback parser, and coordinator.
• Sideload debug assembly and lint passed; diff check passed.
• Final debug APK passed Basic, self-hosted OIDC, and Nous sign-in on Samsung API 36 with Battery Saver off. See docs/audits/2026-09-29-android-native-auth-callback.md for exact evidence and limits.