security: 关闭file跨域+混合内容+调试 + SHA256完整性校验

CRITICAL修复:
- 移除allowFileAccessFromFileURLs/allowUniversalAccessFromFileURLs
- 移除MIXED_CONTENT_ALWAYS_ALLOW
- WebContentsDebugging仅DEBUG模式开启
- 下载HTML用Web Crypto SHA256校验（version.txt|url|sha256）

packages/client-android/android/app/src/main/assets/index.html

@@ -15,7 +15,7 @@ h1{font-size:18px;color:#38bdf8}
 <button class="btn btn-download" onclick="applyUpdate()" id="btnApply" disabled>下载更新</button>
 <div class="log" id="log"></div>
 <script>
-var dlUrl='',dlVer='';
+var dlUrl='',dlVer='',dlSha='';
 var BASE='https://git.childish-ghost.com/LukeMackin/Yuzu-GCA/raw/branch/main/ota';
 
 function log(m){document.getElementById('log').innerText+=m+'\n'}
@@ -24,7 +24,7 @@ function checkUpdate(){
  fetch(BASE+'/version.txt?t='+Date.now(),{cache:'no-store'})
  .then(r=>{if(!r.ok)throw Error('HTTP '+r.status);return r.text()})
  .then(function(t){t=t.trim();log('remote: '+t);
-  var parts=t.indexOf('|')>0?t.split('|'):[t];var remoteVer=parts[0];dlUrl=parts[1]||'';
+  var parts=t.split('|');var remoteVer=parts[0];dlUrl=parts[1]||'';dlSha=parts[2]||'';
   if(!dlUrl)dlUrl=BASE+'/h5/index-v'+remoteVer.replace('0.1.0-dav-android-','')+'.html';
   var local=document.getElementById('ver').innerText;
   if(remoteVer!==local&&remoteVer!=='v'+local&&'v'+remoteVer!==local){
@@ -35,8 +35,15 @@ function checkUpdate(){
 function applyUpdate(){
  log('downloading: '+dlUrl+' ...');
  fetch(dlUrl+'?t='+Date.now(),{cache:'no-store'})
- .then(r=>{if(!r.ok)throw Error('HTTP '+r.status);return r.text()})
- .then(function(t){Android.saveCache(t);log('OK! restart app to apply')})
+ .then(r=>{if(!r.ok)throw Error('HTTP '+r.status);return r.arrayBuffer()})
+ .then(function(buf){
+  return crypto.subtle.digest('SHA-256',buf).then(function(hash){
+   var hex=Array.from(new Uint8Array(hash)).map(function(b){return b.toString(16).padStart(2,'0')}).join('');
+   if(dlSha&&hex!==dlSha){log('SHA256 MISMATCH! expected:'+dlSha.slice(0,16)+'... got:'+hex.slice(0,16)+'...');return}
+   var text=new TextDecoder().decode(buf);
+   Android.saveCache(text);log('OK! restart app to apply')
+  })
+ })
  .catch(function(e){log('ERR: '+e.message)})
 }
 </script></body></html>

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -14,13 +14,12 @@ class MainActivity : AppCompatActivity() {
         super.onCreate(savedInstanceState)
 
         val wv = WebView(this).apply {
-            WebView.setWebContentsDebuggingEnabled(true)
+            if (BuildConfig.DEBUG) {
+                WebView.setWebContentsDebuggingEnabled(true)
+            }
             settings.javaScriptEnabled = true
             settings.domStorageEnabled = true
             settings.allowFileAccess = true
-            settings.allowFileAccessFromFileURLs = true
-            settings.allowUniversalAccessFromFileURLs = true
-            settings.mixedContentMode = android.webkit.WebSettings.MIXED_CONTENT_ALWAYS_ALLOW
             addJavascriptInterface(Bridge(this@MainActivity), "Android")
 
             if (cacheFile.exists()) {