feat(aiturk): pair with AITURK IDE over LAN with a pinned certificate

Adds the phone side of the pairing contract v1: payload parsing, gateway resolve, parallel hello and a single claim, per host:port certificate pinning hooked into OkHttpProvider.base, and no dashboard token refresh for a paired IDE. Adds zxing-android-embedded and okhttp-tls (tests).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8ppceaR5s6cvMnm7uGRnf

app/proguard-rules.pro

@@ -57,3 +57,8 @@
 # Keep screen object class names because their simpleNames are used for bottom nav selection and storage.
 -keep class * extends androidx.navigation3.runtime.NavKey { *; }
 
+# ── AITURK IDE pairing ───────────────────────────────────────────────────
+# Android looks this hostname-aware overload up by reflection (X509TrustManagerExtensions).
+-keepclassmembers class com.m57.hermescontrol.data.aiturk.PinAwareTrustManager {
+    public java.util.List checkServerTrusted(java.security.cert.X509Certificate[], java.lang.String, java.lang.String);
+}