feat(android): oboe/AAudio audio backend + runtime mic permission (step 3)

This is the big one — the Tauri Android app now has a real audio stack
capable of full-duplex VoIP, reusing the proven C++ Oboe bridge from the
legacy wzp-android crate.

Architecture:
- desktop/src-tauri/cpp/  — copies of oboe_bridge.{h,cpp}, oboe_stub.cpp,
  and getauxval_fix.c from crates/wzp-android/cpp/. build.rs clones
  google/oboe@1.8.1 into OUT_DIR and compiles the bridge + all Oboe
  sources as "oboe_bridge" static lib, linking against shared libc++
  (static would pull broken libc stubs that SIGSEGV in .so libraries).
- src/oboe_audio.rs  — Rust side: an SPSC ring buffer matching the C++
  bridge's AtomicI32 layout, plus OboeHandle::start() which returns
  (capture_ring, playout_ring, owning_handle). The ring exposes the same
  (available / read / write) methods as wzp_client::audio_ring::AudioRing
  so CallEngine treats both backends interchangeably.
- src/engine.rs  — compiled on every platform now. A cfg-switched type
  alias picks wzp_client::audio_ring::AudioRing on desktop and
  crate::oboe_audio::AudioRing on Android. The audio setup block has
  three branches: VPIO/CPAL on macOS, CPAL on Linux/Windows, Oboe on
  Android. Send/recv tasks are identical across platforms.
- src/lib.rs  — removes all the "step 3 not done" Android stubs. The
  engine module is no longer cfg-gated; connect / disconnect / toggle_mic
  / toggle_speaker / get_status are single implementations used by both
  desktop and Android. Identity path resolves via app.path().app_data_dir()
  from the Tauri setup() callback (already wired in step 1).

Runtime mic permission:
- scripts/build-tauri-android.sh now injects RECORD_AUDIO + MODIFY_AUDIO_
  SETTINGS into gen/android/app/src/main/AndroidManifest.xml after init,
  and overwrites MainActivity.kt with a version that calls
  ActivityCompat.requestPermissions in onCreate. This is idempotent:
  every build re-applies the patches so tauri re-init can't regress them.

Cargo.toml:
- cc is now an unconditional build-dep (build.rs runs on the host, so
  target-gating build-deps doesn't work).
- wzp-client is now a dep on every platform. On Android it gets default
  features only (no "audio"/"vpio") so CPAL isn't dragged in — oboe_audio
  provides the capture/playout rings instead.
- tracing-android is added on Android so tracing events flow into logcat.

build.rs also gained embedded git hash (WZP_GIT_HASH) capture, which is
shown under the fingerprint on the home screen — already committed in
7639aaf, reinstated here alongside the Oboe build logic.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

desktop/src-tauri/src/lib.rs

@@ -6,12 +6,12 @@
     windows_subsystem = "windows"
 )]
 
-// CPAL-backed audio engine — desktop only. On Android we'll plug in an
-// oboe/AAudio backend in a later step.
-#[cfg(not(target_os = "android"))]
+// Call engine — compiled on every platform. Audio backend is cfg-switched
+// inside engine.rs (CPAL/VPIO on desktop, Oboe on Android).
 mod engine;
+#[cfg(target_os = "android")]
+mod oboe_audio;
 
-#[cfg(not(target_os = "android"))]
 use engine::CallEngine;
 
 use serde::Serialize;
@@ -83,7 +83,6 @@ struct CallStatus {
 }
 
 struct AppState {
-    #[cfg(not(target_os = "android"))]
     engine: Mutex<Option<CallEngine>>,
     signal: Arc<Mutex<SignalState>>,
 }
@@ -152,7 +151,7 @@ async fn ping_relay(relay: String) -> Result<PingResult, String> {
 /// Falls back to `$HOME/.wzp` on the desktop side if the OnceLock hasn't been
 /// initialised yet (shouldn't happen in normal startup, but keeps the fn
 /// total).
-fn identity_dir() -> PathBuf {
+pub(crate) fn identity_dir() -> PathBuf {
     if let Some(dir) = APP_DATA_DIR.get() {
         return dir.clone();
     }
@@ -173,7 +172,7 @@ fn identity_path() -> std::path::PathBuf {
 }
 
 /// Load the persisted seed, or generate-and-persist a new one if missing.
-fn load_or_create_seed() -> Result<wzp_crypto::Seed, String> {
+pub(crate) fn load_or_create_seed() -> Result<wzp_crypto::Seed, String> {
     let path = identity_path();
     if path.exists() {
         let hex = std::fs::read_to_string(&path).map_err(|e| format!("read identity: {e}"))?;
@@ -221,7 +220,6 @@ fn get_app_info() -> Result<AppInfo, String> {
     })
 }
 
-#[cfg(not(target_os = "android"))]
 #[tauri::command]
 async fn connect(
     state: tauri::State<'_, Arc<AppState>>,
@@ -257,7 +255,6 @@ async fn connect(
     }
 }
 
-#[cfg(not(target_os = "android"))]
 #[tauri::command]
 async fn disconnect(state: tauri::State<'_, Arc<AppState>>) -> Result<String, String> {
     let mut engine_lock = state.engine.lock().await;
@@ -269,7 +266,6 @@ async fn disconnect(state: tauri::State<'_, Arc<AppState>>) -> Result<String, St
     }
 }
 
-#[cfg(not(target_os = "android"))]
 #[tauri::command]
 async fn toggle_mic(state: tauri::State<'_, Arc<AppState>>) -> Result<bool, String> {
     let engine_lock = state.engine.lock().await;
@@ -280,7 +276,6 @@ async fn toggle_mic(state: tauri::State<'_, Arc<AppState>>) -> Result<bool, Stri
     }
 }
 
-#[cfg(not(target_os = "android"))]
 #[tauri::command]
 async fn toggle_speaker(state: tauri::State<'_, Arc<AppState>>) -> Result<bool, String> {
     let engine_lock = state.engine.lock().await;
@@ -291,7 +286,6 @@ async fn toggle_speaker(state: tauri::State<'_, Arc<AppState>>) -> Result<bool,
     }
 }
 
-#[cfg(not(target_os = "android"))]
 #[tauri::command]
 async fn get_status(state: tauri::State<'_, Arc<AppState>>) -> Result<CallStatus, String> {
     let engine_lock = state.engine.lock().await;
@@ -335,62 +329,6 @@ async fn get_status(state: tauri::State<'_, Arc<AppState>>) -> Result<CallStatus
     }
 }
 
-// ─── Android stubs for engine-backed commands ────────────────────────────────
-//
-// Step 1 of the Android rewrite: signal-only. Audio is wired up in Step 3.
-// These keep the JS frontend happy (same `invoke` surface) without pulling
-// in CPAL, which doesn't support Android.
-
-#[cfg(target_os = "android")]
-#[tauri::command]
-async fn connect(
-    _state: tauri::State<'_, Arc<AppState>>,
-    _app: tauri::AppHandle,
-    _relay: String,
-    _room: String,
-    _alias: String,
-    _os_aec: bool,
-    _quality: String,
-) -> Result<String, String> {
-    Err("audio backend not yet wired on Android (step 3)".into())
-}
-
-#[cfg(target_os = "android")]
-#[tauri::command]
-async fn disconnect(_state: tauri::State<'_, Arc<AppState>>) -> Result<String, String> {
-    Ok("not connected".into())
-}
-
-#[cfg(target_os = "android")]
-#[tauri::command]
-async fn toggle_mic(_state: tauri::State<'_, Arc<AppState>>) -> Result<bool, String> {
-    Err("not connected".into())
-}
-
-#[cfg(target_os = "android")]
-#[tauri::command]
-async fn toggle_speaker(_state: tauri::State<'_, Arc<AppState>>) -> Result<bool, String> {
-    Err("not connected".into())
-}
-
-#[cfg(target_os = "android")]
-#[tauri::command]
-async fn get_status(_state: tauri::State<'_, Arc<AppState>>) -> Result<CallStatus, String> {
-    Ok(CallStatus {
-        active: false,
-        mic_muted: false,
-        spk_muted: false,
-        participants: vec![],
-        encode_fps: 0,
-        recv_fps: 0,
-        audio_level: 0,
-        call_duration_secs: 0.0,
-        fingerprint: String::new(),
-        tx_codec: String::new(),
-        rx_codec: String::new(),
-    })
-}
-
 // ─── Signaling commands — platform independent ───────────────────────────────
 
 struct SignalState {
@@ -508,7 +446,6 @@ pub fn run() {
     tracing_subscriber::fmt().init();
 
     let state = Arc::new(AppState {
-        #[cfg(not(target_os = "android"))]
         engine: Mutex::new(None),
         signal: Arc::new(Mutex::new(SignalState {
             transport: None, fingerprint: String::new(), signal_status: "idle".into(),