fix(android): 安全修复 — SHA256原生层计算+TOCTOU+域名白名单

- PackageInstallerModule: DigestInputStream边写边算SHA256, 原生层校验消除TOCTOU
- updater: remove expo-crypto, add download domain whitelist, 错误消息去敏感路径
- package.json: 移除expo-crypto依赖(不再需要JS侧SHA256)

packages/client-android/modules/package-installer/android/src/main/java/dev/yuzu/gca/PackageInstallerModule.kt

@@ -9,24 +9,25 @@ import expo.modules.kotlin.modules.Module
 import expo.modules.kotlin.modules.ModuleDefinition
 import java.io.File
 import java.io.FileInputStream
+import java.security.DigestInputStream
+import java.security.MessageDigest
 
 class PackageInstallerModule : Module() {
     override fun definition() = ModuleDefinition {
         Name("PackageInstallerModule")
 
-        AsyncFunction("installApk") { filePath: String ->
-            installApk(filePath)
+        AsyncFunction("installApk") { filePath: String, expectedSha256: String ->
+            installApk(filePath, expectedSha256)
         }
     }
 
-    private fun installApk(filePath: String) {
+    private fun installApk(filePath: String, expectedSha256: String) {
         val context: Context = appContext.reactContext ?: return
         val apkFile = File(filePath)
-        if (!apkFile.exists()) throw Exception("APK file not found: $filePath")
+        if (!apkFile.exists()) throw Exception("安装包不存在")
 
-        // 检查 REQUEST_INSTALL_PACKAGES 权限
         if (!context.packageManager.canRequestPackageInstalls()) {
-            throw SecurityException("REQUEST_INSTALL_PACKAGES 权限未授予，请在系统设置中允许")
+            throw SecurityException("REQUEST_INSTALL_PACKAGES 权限未授予")
         }
 
         val packageInstaller = context.packageManager.packageInstaller
@@ -38,14 +39,21 @@ class PackageInstallerModule : Module() {
         val session = packageInstaller.openSession(sessionId)
 
         try {
+            // 边写入边计算 SHA256（原子化，避免 TOCTOU）
+            val sha256 = MessageDigest.getInstance("SHA-256")
             FileInputStream(apkFile).use { input ->
+                val digestStream = DigestInputStream(input, sha256)
                 session.openWrite("package", 0, apkFile.length()).use { output ->
-                    input.copyTo(output)
+                    digestStream.copyTo(output)
                     session.fsync(output)
                 }
             }
 
-            // 安装完成后发送通知，用户点击即重启
+            val actualSha256 = sha256.digest().joinToString("") { "%02x".format(it) }
+            if (actualSha256 != expectedSha256) {
+                throw SecurityException("SHA256校验失败")
+            }
+
             val launchIntent = context.packageManager.getLaunchIntentForPackage(context.packageName)
                 ?: throw Exception("无法获取启动Intent")
             val pendingIntent = PendingIntent.getActivity(