[bardesss]

Sign-in, sign-out and stored credentials. Stacked on #37.

• A 403 from ClientLogin maps to BadCredentials, so a wrong key shows "Username or API key is wrong" instead of "The server refused access".
• KeystoreCredentialStore.load tries decryption 3 times. Only a permanent failure (AEADBadTagException, KeyPermanentlyInvalidatedException, UnrecoverableKeyException, bad base64, or plaintext without a newline) deletes the stored sign-in. Any other error keeps it for the next start, and a failing removal can no longer crash startup.
• An address that HttpUrl cannot parse, or that is not https, shows "That address doesn't look right" before any request. The Sign in button is disabled while a field is blank.
• AccountSwitch compares account ids without case, so signing in again as Alice instead of alice keeps the local data and queued marks.
• Settings has a close button ("Close settings"). Sign out needs a second tap, "Tap again to sign out", using the same MarkAllArm and 4 s timeout as mark all read. HeaderIcon and the timeout constant are now shared.

Tests: GReaderApiTest, CredentialStoreTest, LoginViewModelTest, new LoginScreenTest, SignOutTest and SettingsScreenTest. Full unit tests and lint pass.