fix(security): usesCleartextTraffic移除 + 域名白名单 + JSONObject解析

- AndroidManifest: 移除 usesCleartextTraffic=true
- downloadFile: 增加 ALLOWED_HOSTS 白名单(git.childish-ghost.com/github.com)
- manifest解析: indexOf/substring → org.json.JSONObject

packages/client-android/android/app/src/main/AndroidManifest.xml

@@ -8,7 +8,6 @@
         android:label="Yuzu GCA v0.1.0"
         android:allowBackup="false"
         android:supportsRtl="true"
-        android:usesCleartextTraffic="true"
         android:theme="@style/Theme.AppCompat.DayNight">
 
         <activity

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -13,6 +13,7 @@ import java.io.FileOutputStream
 import java.net.HttpURLConnection
 import java.net.URL
 import java.security.MessageDigest
+import org.json.JSONObject
 
 class MainActivity : AppCompatActivity() {
     private lateinit var logView: TextView
@@ -132,15 +133,11 @@ class MainActivity : AppCompatActivity() {
         var manifestApkUrl = ""
         var manifestTag = ""
         try {
-            fun extractJson(key: String): String {
-                val field = "\"$key\": \""
-                val start = manifestJson.indexOf(field) + field.length
-                val end = manifestJson.indexOf("\"", start)
-                return manifestJson.substring(start, end)
-            }
-            manifestSha256 = extractJson("sha256")
-            manifestApkUrl = extractJson("url")
-            manifestTag = extractJson("tag")
+            val json = JSONObject(manifestJson)
+            val android = json.getJSONObject("builds").getJSONObject("android")
+            manifestSha256 = android.getString("sha256")
+            manifestApkUrl = android.getString("url")
+            manifestTag = android.getString("tag")
             appendLog("  渠道: $channel  版本: $manifestTag")
             appendLog("  SHA256: ${manifestSha256.take(16)}...")
         } catch (e: Exception) {
@@ -180,7 +177,13 @@ class MainActivity : AppCompatActivity() {
         return conn.inputStream.bufferedReader().readText()
     }
 
+    private val ALLOWED_HOSTS = setOf("git.childish-ghost.com", "github.com")
+
     private fun downloadFile(url: String, dest: File) {
+        val host = URL(url).host
+        if (!ALLOWED_HOSTS.any { host == it || host.endsWith(".$it") }) {
+            throw SecurityException("不允许的下载域名: $host")
+        }
         val conn = URL(url).openConnection() as HttpURLConnection
         conn.connectTimeout = 30000
         conn.readTimeout = 120000