merge: Android runtime security (B1, B3)

Correct the POST_NOTIFICATIONS mechanism: the lockscreen notification is exempt
because of the MediaSession token, not because it belongs to a foreground
service — FGS notifications are explicitly NOT exempt. So no permission prompt
and no checkSelfPermission gate; instead both notification builders bind the
token once and log loudly if it is ever null, turning a silent failure into a
logcat line. Stop the webview undoing the network security config:
mixedContentMode COMPATIBILITY, allowFileAccess/allowContentAccess false.

Conflict resolution: this branch's DR-198 collided with the Tauri branch's, so
it was renumbered DR-200 (3 TRACES in JellyTauPlaybackService.kt and the UR-006
matrix row updated). DR-199 was uncontested. Pinned counts summed to DR 191 /
total 334; UR-071 takes both DR-198 and DR-199.

scripts/extract-traces.test.ts

@@ -264,12 +264,14 @@ describe("live requirements.md", () => {
 
     expect(defined.UR).toBe(75);
     expect(defined.IR).toBe(32);
-    // 189 = 187 + two independently-added requirements that landed together:
-    // DR-189 (the definition its TRACES comments in VideoPlayer.svelte /
-    // controlsVisibility.ts had always referenced) and DR-198 (asset-protocol
-    // scope). Each branch bumped 187 -> 188 for its own; merged, they sum.
-    expect(defined.DR).toBe(189);
+    // 191 = 187 + four requirements added independently on four branches
+    // that landed together: DR-189 (control-bar auto-hide), DR-198 (asset
+    // scope/CSP), DR-199 (webview mixed-content) and DR-200 (the
+    // POST_NOTIFICATIONS media-session exemption; renumbered from 198 on
+    // merge, where it collided). Each branch bumped for its own — merged,
+    // they sum. Resolve this by summing, never by taking one side.
+    expect(defined.DR).toBe(191);
     expect(defined.JA).toBe(36);
-    expect(defined.total).toBe(332);
+    expect(defined.total).toBe(334);
   });
 });