Merge: a log that survives the process, so the tablet can be debugged

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	apps/darkroom-android/Cargo.toml
#	apps/darkroom-desktop/Cargo.toml
#	platform/dr-plat/src/lib.rs

apps/darkroom-android/src/lib.rs

@@ -6,8 +6,10 @@
 //! * There are no command-line paths. Android's SAF hands out document URIs,
 //!   not filesystem paths (ARCH §6.9), so the viewer opens with an empty
 //!   browsing list and the library grid is the only way in.
-//! * Logging goes to logcat. `env_logger` writes to stderr, which Android
-//!   discards.
+//! * Logging goes to logcat *and* to a file. `env_logger` writes to stderr,
+//!   which Android discards; logcat replaces it, and a rotating file beside it
+//!   replaces the thing logcat cannot be — a record that outlives the session
+//!   and can be sent to somebody (NFR-OPS-1, [`dr_plat::diagnostics`]).
 //!
 //! The first of those has one exception, and it is the launch `Intent`: a
 //! gallery, a file manager or the share sheet can name images to open, and
@@ -29,11 +31,39 @@ mod intents;
 /// Android application entry point, called by android-activity's glue.
 #[no_mangle]
 fn android_main(app: slint::android::AndroidApp) {
-    android_logger::init_once(
+    // Before the logger, because the logger needs somewhere to write, and
+    // before any `log::` call at all, because records emitted before this line
+    // reach nothing.
+    //
+    // **The external directory, not the internal one, and the difference is
+    // the entire point of the file.** Both are app-private and both survive
+    // backgrounding — the volatile one is the *cache* directory, which is not
+    // in play here. What separates them is retrieval:
+    // `/data/data/<pkg>/files` needs `run-as` against a debuggable build or
+    // root to read, and `/sdcard/Android/data/<pkg>/files` is a plain
+    // `adb pull` from any build, needing no permission since API 19. A log
+    // nobody can get off the device does not do the job NFR-OPS-1 describes.
+    //
+    // The consequence is that anyone holding the tablet can read it, which is
+    // why `dr_plat::diagnostics` redacts at the sink and why configuration —
+    // the account list, and the credential reference beside it — stays on
+    // `internal_data_path` below rather than moving here (NFR-SEC-2).
+    let external = app.external_data_path();
+    if let Some(dir) = external.clone().or_else(|| app.internal_data_path()) {
+        dr_plat::set_state_dir(dir);
+    }
+
+    // `AndroidLogger` rather than `init_once`, so logcat can be *teed* rather
+    // than replaced: `init_once` installs itself as the global logger and
+    // there is only one of those. Everything that reached logcat before this
+    // change still reaches it, at the same level and under the same tag; the
+    // file is strictly additional.
+    let console = android_logger::AndroidLogger::new(
         android_logger::Config::default()
             .with_max_level(log::LevelFilter::Info)
             .with_tag("DarkRoom"),
     );
+    let logging = dr_plat::diagnostics::install(Box::new(console), log::LevelFilter::Info);
 
     // Panics go to stderr, and Android discards stderr. Without this hook a
     // worker thread that panics is invisible: the process survives, the
@@ -54,6 +84,25 @@ fn android_main(app: slint::android::AndroidApp) {
 
     log::info!("DarkRoom v{}", env!("CARGO_PKG_VERSION"));
 
+    // Said in logcat as well as in the file, because the first thing anybody
+    // asked for a log needs is where it is — and on a device that is a path
+    // nobody can guess and a command nobody remembers.
+    match &logging {
+        dr_plat::Installed::ToFile(path) => {
+            log::info!("logging to {}", path.display());
+            if external.is_none() {
+                log::warn!(
+                    "no external storage; the log is app-private and needs \
+                     `adb shell run-as paris.tourolle.darkroom cat files/darkroom.log` \
+                     on a debuggable build"
+                );
+            }
+        }
+        dr_plat::Installed::ConsoleOnly(why) => {
+            log::warn!("no log file this session, only logcat: {why}");
+        }
+    }
+
     // Before anything opens a store: Android has no $HOME and no XDG
     // directories, so the default guess resolves to a path the app cannot
     // write. Nothing failed loudly — the session list went to a doomed path, so