Ride on Android: the same BLE stack, over JNI

G-4 said port to Android without rewriting the core, and nothing in
crates/core, crates/ble or crates/fit needed touching (NFR-5) — the
Android work is two files of glue and a Gradle project.

btleplug's Android backend is a hybrid crate: the GATT work happens in
Java and Rust drives it over JNI. `platform::init` has to run once with a
JNIEnv, and it cannot come from Rust's own startup — JNI resolves classes
with the calling thread's class loader, and a thread Rust spawned has
only the bootstrap loader. So MainActivity.onCreate calls into
src/android.rs, before super.onCreate: TauriActivity's super chain
synchronously starts the thread that runs `run()`, which builds AppState
and starts scanning while we are still in onCreate. Lose that race and
droidplug's global_adapter() — an `expect` — panics inside the scan task,
silently, for the life of the process.

Failing soft here is not enough for the same reason, so init sets a READY
flag and devices.rs asks before every call in. Bluetooth switched off at
launch then reads as an ordinary "no adapter", which the connection
screen already knows how to show, and onResume retries so switching it on
and coming back works.

The Java half is not a maven dependency. Upstream tells you to publish a
0.1.1-SNAPSHOT artifact to mavenLocal by hand, which no CI runner can
reproduce and which drifts from the crate silently — the failure is a
NoSuchMethodError at the first scan, not a build error. Instead
sync-android-sources.sh lifts the classes out of the btleplug and
jni-utils crate sources at exactly the versions in Cargo.lock, so a
mismatch is impossible by construction.

gen/ stays generated and untracked, so everything hand-written lives in
src-tauri/android/ and is copied back after each `tauri android init`.
check-android-sources.sh fails the build if a source exists only under
gen/ or differs from its tracked copy: both are files git has never seen
and the next init deletes, and the resulting APK builds, installs, and
behaves as though they were never written.

Permissions are split at API 31, because asking for one the platform does
not know is a permanent denial. neverForLocation on BLUETOOTH_SCAN is a
promise we can keep honestly: every scan filters by service UUID, so no
location permission is needed on Android 12+.

Also: tracing to logcat, since Android has no stdout and the default
writer drops every line into a closed fd.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/check-android-sources.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Fail if any hand-written Android source has ended up only in gen/android.
+#
+# src-tauri/gen/ is not tracked and `tauri android init` rewrites it, so a
+# Kotlin file edited *there* is a file that will be silently deleted by the next
+# init and has never existed in git. That failure is quiet in exactly the wrong
+# way: the build keeps working locally for as long as nobody re-inits, and then
+# a CI release APK ships without whatever the file did.
+#
+# Every source under gen/android/app/src/main/java must therefore be one of:
+#
+#   1. Tauri's own, under <pkg>/generated/ and carrying the AUTO-GENERATED
+#      banner. Regenerated on every init; not ours to keep.
+#   2. A copy of a tracked file in src-tauri/android/, byte for byte. If it
+#      differs, the edit was made in gen/ and is about to be lost.
+#   3. Vendored from a crate by sync-android-sources.sh — the btleplug and
+#      jni-utils Java backends.
+#
+# Anything else is hand-written and untracked, and this exits non-zero.
+#
+#   scripts/check-android-sources.sh
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+TRACKED="$ROOT/src-tauri/android/src/main/java"
+GEN="$ROOT/src-tauri/gen/android/app/src/main/java"
+
+if [ ! -d "$GEN" ]; then
+  echo "ℹ️  No generated Android project — nothing to check."
+  echo "   (run 'cargo tauri android init' then scripts/sync-android-sources.sh)"
+  exit 0
+fi
+
+fail=0
+drift=0
+
+while IFS= read -r file; do
+  rel="${file#"$GEN"/}"
+
+  case "$rel" in
+    # 3. Vendored from the crates.
+    com/nonpolynomial/btleplug/*|io/github/gedgygedgy/rust/*)
+      continue
+      ;;
+  esac
+
+  # 1. Tauri's own.
+  if [ "${rel#*/generated/}" != "$rel" ] && head -8 "$file" | grep -q 'AUTO-GENERATED'; then
+    continue
+  fi
+
+  # 2. Ours — must exist in src-tauri/android and match.
+  if [ -f "$TRACKED/$rel" ]; then
+    if ! cmp -s "$TRACKED/$rel" "$file"; then
+      echo "❌ $rel differs from the tracked copy."
+      echo "   Edited in gen/ — the next 'tauri android init' will delete it."
+      echo "   Move the change into src-tauri/android/src/main/java/$rel"
+      drift=1
+    fi
+    continue
+  fi
+
+  echo "❌ $rel is hand-written and untracked."
+  echo "   Move it to src-tauri/android/src/main/java/$rel and add it to the"
+  echo "   copy list in scripts/sync-android-sources.sh."
+  fail=1
+done < <(find "$GEN" -type f \( -name '*.kt' -o -name '*.java' \))
+
+# The other direction: a tracked source the sync script never copies is dead
+# code that looks live.
+while IFS= read -r file; do
+  rel="${file#"$TRACKED"/}"
+  if [ ! -f "$GEN/$rel" ]; then
+    echo "❌ src-tauri/android/src/main/java/$rel is tracked but never reached gen/."
+    echo "   Add it to scripts/sync-android-sources.sh, or delete it."
+    fail=1
+  fi
+done < <(find "$TRACKED" -type f \( -name '*.kt' -o -name '*.java' \) 2>/dev/null || true)
+
+if [ "$fail" = 1 ] || [ "$drift" = 1 ]; then
+  exit 1
+fi
+
+echo "✅ Every hand-written Android source is tracked in src-tauri/android/"