feat: multi-tenant — let a learner choose which Open edX platform to sign in to - #496

A build normally talks to exactly one site, named in config.yaml. With
LMS_DIRECTORY enabled it instead shows the platforms listed in a JSON document,
re-themes to whichever the learner picks — logo, accent colour, sign-in artwork —
and signs in against that one. Logging out returns to the list, so a device can
move between platforms without a new build.

Off by default: with ENABLED false none of this runs.

The document is the whole contract. It comes from a URL or from the app's assets,
and nothing downstream can tell which — so a build can ship its list and its
images and never ask the network for either. Because the whole list arrives at
once, every platform's sign-in background is known before anything is tapped,
which is what lets that artwork be warmed while the learner is still choosing
rather than assembling itself afterwards.

Image references carry either an http(s) address or the name of a file in
assets, which Coil reads as file:///android_asset/… natively. One field, one
rule: the alternative was a parallel set of asset fields and a precedence rule
to go with them, which puts the rule in documentation instead of in the value.

Documentation/LMSDirectory.md has the format, both delivery modes and a worked
example.

The app crashed on launch with the directory configured: Koin had no definition
for SiteSelectionViewModel, so the very first screen threw. Unit tests and the
build were both green — it took running the app to see it.

The rest is design parity, from putting the two screens side by side:

- the title sat under the status bar, so the screen needed statusBarsPadding;
- secondary text used appColors.textSecondary, which on Android is a light grey
  (#B3B3B3) while the token of that name on iOS is the slate #3D4964. The colour
  iOS actually draws is textPrimaryVariant here, so the subtitle, the host, the
  provider line and the chevron all use that;
- the chevron was the accent colour, where iOS draws it in the same secondary
  ink as the text;
- rows padded 12/10/10/4 against iOS's even 16, and the platform name used a
  title style where iOS uses bodyLarge.

The wire format here already allowed it — api and oauth_client_id are nullable,
and Config falls back to the app's own client id. Nothing to change, but the
mobile working group settled that this is the model rather than an accident, so
it is worth a test that fails if someone tightens the DTO later.

The matching iOS change makes the same document decode there.

The id came from the registry that produced the first document, where it is a
primary key. It means nothing to a client, so the schema is better without it.

What replaces it is the position in the file, not the URL. Two entries may
legitimately name the same address — the same LMS listed twice under different
branding — and identifying by URL merges them, so opening one row would give
another row's settings. Compose survived that by accident, because the list is
keyed by index; iOS did not, which is how it was found.

A test holds a two-entry document that shares one address, so neither platform
can regress into merging them.