Add Android Always-On VPN support

[Tosko4]

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

Adds complete Android Always-On VPN support rather than only exposing the manifest setting.

Android can create the VPN service after boot without opening an activity, so the manager graph now lives in PangolinApplication and is shared with MainActivity. A system-started tunnel reuses the existing encrypted account, session, and OLM state without starting an interactive credential flow or adding another credential store.

The change also:

• serializes connect and disconnect operations to prevent overlapping tunnel work;
• keeps manual service starts non-sticky and Android-owned Always-On starts sticky;
• starts a systemExempted foreground VPN service with a status notification;
• retries temporary startup failures with bounded, network-aware backoff while leaving missing account state, expired sessions, and missing VPN authorization terminal;
• prevents in-app disconnect while Android still owns Always-On;
• reports Connected only after registration, Android-applied network settings, and a connected private peer or exit node are all present.

This is related to #12 and intentionally stays separate from the DNS filtering, tunnel permission, and network-settings acknowledgement changes in #44, #45, and #46.

How to test?

ANDROID_HOME=/path/to/android-sdk ./gradlew test assembleRelease

Focused regression coverage includes Always-On ownership and restart policy, bounded reconnect backoff, permanent versus retryable startup failures, manual-disconnect policy, and strict tunnel readiness.

I also ran an Android 15 / API 35 emulator lifecycle test. It verified that the VPN service can start without an activity, is accepted as a systemExempted foreground service, survives the foreground-service deadline, creates its notification channel, and keeps a manual start non-Always-On. The emulator did not have an authenticated Pangolin account, so this does not claim a real server registration, peer handshake, or OEM-specific background-management result.

The tunnel module has existing release-lint failures on dev. The clean base reports 7 errors and 6 warnings; this branch reports 4 errors and 6 warnings. The remaining four are the existing ACCESS_NETWORK_STATE findings handled separately by #45, and this change introduces no new lint finding.