Measure whether the Android shell reaches a plain-http model server on the LAN

[mgcronin]

Description

Measure whether the Android shell can reach a plain-http: model server on the rider's LAN at all. #387 shipped the transport; this is the device measurement it could not make.

The Android shell serves the app from a secure origin (https://localhost) and sets android: { allowMixedContent: false } in apps/mobile/capacitor.config.ts. #387's transport annotates every request with targetAddressSpace (local or loopback), which Chromium's Local Network Access rules use to relax mixed-content blocking for a private IP literal or a .local name once the permission is granted. Whether the Android System WebView does the same, prompts for it, or blocks the request outright has not been measured. If it blocks, the default transport ADR 0029 D-6 adopts ("plain LAN") does not work inside the APK, and riders need an https: endpoint their phone trusts.

docs/analysis-on-your-own-computer.md says to the rider that this is untried, rather than implying it works.

Acceptance criteria

• On the owner's tablet (validation 0002's device), with a model server on the LAN at http://192.168.x.y:PORT, the Camera page's connection check is run and its result recorded in a new validation 0002 Part, with the WebView version.
• If it fails with unreachable: record which layer refused (mixed content, LNA, cleartext policy) from adb logcat, and decide — in an issue or ADR, not a config tweak — whether any shell setting may change. allowMixedContent and cleartext traffic are security settings, and changing either is not a drive-by.
• The rider-facing document is updated with what was measured.

Refs #387.