Add Android Play Integrity verifier and refresh path

[aliXsed]

Summary

• Trait-mocked Google decodeIntegrityToken client (reqwest + gcp_auth ADC) with a consecutive-failure circuit breaker, plus a local verdict policy engine (PLAY_RECOGNIZED, device floor, package/cert trust, 300s freshness, iteration-1 requestHash = SHA256(challenge ‖ wallet)).
• POST /v1/attest/android and Android support on POST /v1/attest/refresh; on transient Google failures, extend an existing Android record’s grace once and return a retryable error without breaking the wallet session.
• Synthetic Play Integrity fixture (regenerated for the iteration-1 hash) and integration tests that inject MockPlayIntegrityClient so CI never needs GCP credentials.

Stacked on #21 (feat/ios-app-attest-verifier). Retarget to main after that lands.

Test plan

• cargo test --workspace
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo fmt --check
• Confirm fixture policy unit tests pass (evaluate_verdict / JWE precheck)
• Confirm /v1/attest/android with a mocked verdict mints tier=attested / att.platform=android
• Confirm Google outage path returns 5xx/429 and sets grace_extended only once
• Confirm malformed integrity tokens are rejected before any decode call

Made with Cursor

[github-actions]

Coverage report

Thresholds: 80% line · 78% region (condition)

✅ Coverage meets the required threshold.

   13|      1|            .init(),
   14|      3|        _ => registry.with(tracing_subscriber::fmt::layer()).init(),
   15|       |    }
   16|      4|}