security: SHA256强制+dlUrl域名校验+缓存大小限制(500KB)

- saveCache: >500KB拒绝写入
- index.html: SHA256缺失时拒绝(不再静默跳过)
- index.html: dlUrl域名校验(dlUrl.indexOf(BASE)===0)
- 审查建议全部修复

packages/client-android/android/app/src/main/java/dev/yuzu/gca/MainActivity.kt

@@ -40,6 +40,10 @@ class MainActivity : AppCompatActivity() {
     inner class Bridge(private val ctx: MainActivity) {
         @android.webkit.JavascriptInterface
         fun saveCache(html: String) {
+            if (html.length > 500_000) {
+                Log.w(TAG, "Cache rejected: too large (${html.length}B)")
+                return
+            }
             ctx.cacheFile.writeText(html)
             Log.i(TAG, "Hot-update HTML saved (${html.length}B)")
         }