fix(mobile): align native onboarding, GitHub login and remote session flows

[wgqqqqq]

Summary

Mobile controllers now offer notification permission during first-launch onboarding, preserve remote-session send authority when the visible session list is filtered, and provide consistent native account and conversation controls.

• Add optional notification onboarding on iOS, Android and HarmonyOS, with persisted Later/Enable choices and an iOS settings recovery entry.
• Fix iOS sending to an opened remote session absent from the current list; preserve upstream attachment handling.
• Align iOS sidebar hierarchy and floating New Chat controls with the mobile references. Make GitHub login compact and open the authorization browser automatically, with a reusable retry action.
• Add capability-gated harness modes, GitHub profile/avatar enrichment, completion observation, and speech-draft handling for Android/iOS.
• Generate an opaque iOS App Store icon and prioritize the explicit Chinese font on the shared authorization completion webpage.

Type and Areas

Type: Bug fixes / UI/UX / tests

Areas: iOS, Android, HarmonyOS, mobile shared core, MiniApp market authorization page, brand assets

Motivation / Impact

Users can send from a correctly opened remote session without silently failing because the sidebar list differs. Notification permission is offered before the first task instead of appearing during task execution. iOS login no longer requires a second blue-link tap, and the sidebar's New Chat button creates conversations instead of reconnecting. The authorization completion page avoids the missing Chinese glyphs reproduced in iOS Simulator Safari.

Verification

After rebasing onto upstream/main:

• iOS Testing/run-pure-swift-tests.sh: passed.
• Android ./gradlew :app:assembleDebug: passed.
• Shared iOS ./gradlew :core-feature:assembleOpenBitFunMobileCoreDebugXCFramework: passed.
• iOS xcodebuild -project OpenBitFun.xcodeproj -scheme OpenBitFun -destination 'platform=iOS Simulator,name=iPhone 17 Pro' build: passed after regenerating the shared framework for upstream's new lastSentMessage field.

Focused checks passed during this work:

• Shared core ./gradlew :core-feature:jvmTest :core-transport:jvmTest.
• pnpm run mobile:architecture; node --test scripts/generate-brand-assets.test.mjs (12 tests).
• iOS simulator build and notification-onboarding, sidebar compact/wide scrolling, and GitHub browser-handoff UI tests.
• Android build/install and notification-onboarding instrumentation tests (2 tests).
• HarmonyOS HAP build and local tests; installed on a phone emulator and inspected a signed-in remote device/workspace sidebar.
• MiniApp market type-check, tests (17 tests), and production build; verified repaired Chinese rendering in the same iOS Simulator Safari.
• pnpm run theme:color-audit:native-mobile.

pnpm run theme:color-audit:all remains blocked by the existing missing @xterm/headless/lib-headless/xterm-headless.mjs dependency during startup-appearance generation.

Reviewer Notes

• Shared harness modes remain gated by harness_profiles_v1; old payloads keep the legacy path. Display metadata is separate from account authority and preserves credentials on refresh failures.
• Notifications are local and subject to platform background execution limits, not a promise of push delivery after process termination.
• Remote control was exercised against a real host for iOS sending and HarmonyOS directory browsing. Dedicated SSH remote-workspace, Peer Device Mode and Detached Dispatch scenarios were not exercised.
• The authorization-page font fix is source-only; this PR does not deploy the production website.
• Screenshots, local diagnostic output and Xcode user-state files are excluded.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.