fix(android): allow network requests and relax WebView CSP

Enable cleartext HTTP in release APK, add network security config, and set connect-src CSP. Add CORS on Worker API for cross-origin fetches from packaged apps.

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/build-app.yml

@@ -145,7 +145,7 @@ jobs:
         env:
           NDK_HOME: ${{ env.ANDROID_HOME }}/ndk/${{ env.NDK_VERSION }}
 
-      - name: Disable edge-to-edge system bars on Android
+      - name: Patch Android app (system bars + network)
         run: node .github/scripts/patch-android-system-bars.mjs
 
       - name: Regenerate app icons for Android