feat(#416): support Android 16 (API 36)

[binokaryg]

Closes #416

Description

Targets Android 16 (API 36) ahead of Google Play's Aug 31, 2026 target API deadline, and addresses the Play Store's large-screen recommendation by removing the portrait orientation locks.

Toolchain

• compileSdk / targetSdkVersion 35 → 36.
• AGP 8.8.2 → 8.10.1 and Gradle 8.10.2 → 8.11.1. This reverts the bug: app bundling fails with current gradle version #422 rollback, which was needed because AGP ≥ 8.9 fails bundle builds when ABI splits are enabled (issuetracker/402800800, won't-fix). Since compileSdk 36 requires AGP ≥ 8.9.1, the rollback couldn't stay. Workaround: ABI splits are now disabled automatically whenever a bundle* task is invoked. Safe here because CI and the Makefile always run assemble and bundle as separate Gradle invocations.

Manifest

• Removed android:screenOrientation="portrait" from all nine activities (flagged by the Play Store). Android 16 ignores these locks on large screens anyway. configChanges="orientation|screenSize" is kept so rotation does not recreate activities — notably the webview is not reloaded on rotate.
• Added android:enableOnBackInvokedCallback="false". Targeting SDK 36 enables predictive back by default, which silently stops onBackPressed() from being called — breaking the webview back-navigation JS bridge (EmbeddedBrowserActivity), SettingsDialogActivity, and ClosableAppActivity. The opt-out preserves current behavior; migrating to OnBackInvokedCallback can be a follow-up issue.

Tests

• Robolectric 4.15.1 → 4.16.1 (required for SDK 36 emulation). Note: Robolectric needs a Java 21 runtime to emulate SDK 36, so CI now sets up Temurin 21 (was AdoptOpenJDK 17) and running unit tests locally requires Java 21 too. Compile source/target compatibility stays at 17.
• Replaced the discontinued mockito-inline 5.2.0 with mockito-core 5.23.0 (the old ByteBuddy cannot instrument classes alongside Robolectric 4.16; inline mocks are the default since Mockito 5).
• Robolectric 4.16 dropped emulation of SDK < 23, so the two LSmsSender tests now force Build.VERSION.SDK_INT = 22 via ReflectionHelpers instead of @Config(sdk = 22). The pre-M code path is still shipped (minSdkVersion 21) and still tested.

Testing

• Android lint (warnings-as-errors), checkstyle, PMD, SpotBugs: pass.
• assembleUnbrandedDebug produces both ABI-split APKs; bundleUnbrandedRelease — the exact task that failed in bug: app bundling fails with current gradle version #422 — builds successfully.
• Manual verification on a Pixel 9 AVD running Android 16 (API 36), against a CHT 4.x instance:
  • App installs, launches, logs in, and completes initial replication.
  • Tasks / Reports / People navigation works.
  • System back triggers onBackPressed() (confirmed in logcat) — the predictive-back opt-out works when targeting SDK 36.
  • Rotation: settings screens and the webview lay out correctly in landscape; the webapp switches to its two-pane layout and the webview is not reloaded.
  • Backgrounding and resuming restores the app where it left off.

Notes for reviewers

• Behavior change for users: screens are no longer locked to portrait on any device. If product prefers keeping phones portrait-only while satisfying the Play Store (which only enforces large screens), that needs a different approach (e.g. runtime setRequestedOrientation gated by screen size) — flagging for discussion.
• While testing, the back button backgrounds the app from anywhere in the webapp because the JS bridge call (angular.element(document.body).injector().get('AndroidApi').v1.back()) throws angular is not defined on CHT 4.x. This is pre-existing on all Android versions and probably deserves its own issue.

AI Disclosure

This PR was written primarily by Claude Code (Claude Fable 5), working interactively under my direction: it investigated the #422 rollback and the AGP bundling bug, made the Gradle/manifest/test changes, and ran the verification (unit tests, lint/static analysis, APK and bundle builds, and manual testing on an Android 16 emulator against a CHT 4.x instance). I reviewed the changes, chose the approach at each decision point (AGP workaround, predictive-back opt-out, incremental commits), and did the final review of this description.