feat(#11281): bring up the wifi hotspot and pairing

[paulpascal]

Closes #11281 (android half). The webapp half is medic/cht-core#11450.

Brings up a local-only hotspot and a local server behind it, so two phones can pair with no network.

The host starts a LocalOnlyHotspot and serves over TLS, with a key made for the session in the Android keystore. The QR carries the ssid, password, ip, port, a timestamp and the fingerprint of the host's public key. The peer scans it, joins, and checks the host against that fingerprint before pairing counts as done, so a network that only has the right name is not enough.

We pin the public key, not the whole certificate: the keystore can hand back different certificate bytes than the TLS stack presents for the same key, and only the key proves who the host is.

A platform limit shapes this. LocalOnlyHotspot needs API 26 while our minSdk is 21, so hosting is gated at 26 and reported through offline_sync_host_available(), like mrdt_available() and sms_available(). Joining works on everything we support: WifiNetworkSpecifier from API 29, a saved network below it.

Before hosting, the session key self-tests with a real loopback handshake, so a device that cannot serve TLS from the keystore fails right away with a code instead of later at an odd moment.

Everything sent back to the webapp is a stable code, never a sentence, and every code has a key in cht-core in all five languages. The 7 bridge methods keep their snake_case names (the webapp calls them by that string), so they carry @SuppressWarnings("java:S100"). Happy to switch to a project exclusion if you prefer.

If the system stops the hotspot, the server goes down with it and the webapp is told (hotspot_stopped); a peer that loses the network reports network_lost. Keeping the session alive while the app is in the background (a foreground service) comes with #11282, where there is a transfer to protect.