feat(diagnostics): iOS Universal Links validation (apple-app-site-association)

[manjees]

Closes #30.

Summary

Adds an Android/iOS toggle to the Diagnostics screen so the same domain can be validated for both platforms in-place. MVP scope is the applinks section — webcredentials and appclips are surfaced as presence flags only.

Why this matters: real-world deep-link debugging is almost always a pair problem ("works on Android, broken on iOS" or vice versa). LinkOps was previously Android-only, so the moment a user needed to check the iOS side they had to leave the tool. This PR keeps them in.

What's in

Domain (domain/model/AppleAppSiteAssociation.kt)

• AppleAppSiteAssociation / AppLinksSection / AppLinkDetail / AasaPathComponent — normalize both AASA schemas
• AasaValidation / AasaStatus / AasaIssue — mirror the Android assetlinks result shape so the UI scaffold is reusable

Infrastructure (infrastructure/network/AasaClient.kt)

• Tries /.well-known/apple-app-site-association first; falls back to the legacy root path only on 404 so a real SSL/network failure on the recommended path isn't masked
• Treats application/json and application/pkcs7-mime as acceptable Content-Types (Apple historically signed AASAs)
• No automatic redirect following — Apple rejects redirected AASAs, so we want to surface them

Data

• AasaParser (hand-rolled on JsonObject because iOS 14+ uses /, ?, # keys that aren't valid Kotlin identifiers)
• Handles legacy (appID + paths), iOS 14+ (appIDs + components), and mixed entries within the same details array
• AasaRepositoryImpl flags root-path fallback, redirects, missing applinks, empty details, malformed app IDs, missing patterns, non-empty apps array, etc.

UseCase + DI

• ValidateAasaUseCase + AppContainer wiring

UI (ui/screen/diagnostics/)

• DiagnosticsPlatform enum + SegmentedButton toggle at the top of the AssetLinks tab
• ViewModel branches into validateAndroid / validateIos; switching platform clears the previous result so the panel never mixes apples (assetlinks.json) with oranges (AASA)
• Capability chips on the iOS status card show whether the domain also ships webcredentials / appclips
• iOS detail cards show appIDs, paths (with a "Legacy" badge per-detail), and components (with / ? # exclude caseSensitive percentEncoded formatted compactly). Excluded components are tinted to stand out.
• History entries carry their platform and replay on the original platform when clicked

Tests

AasaParserTest — 10 cases covering iOS 14+ schema, legacy schema, mixed entries, missing applinks, empty details, non-empty apps, missing paths/components, malformed app ID, appclips presence, malformed JSON

Test plan

• ./gradlew :composeApp:compileKotlinJvm → BUILD SUCCESSFUL
• ./gradlew :composeApp:jvmTest → all green (incl. 10 new AasaParserTest cases)
• Manual: hit a real AASA-shipping domain (e.g. apple.com, airbnb.com, notion.so) and confirm parsing/issue surfaces
• Manual: hit a domain serving AASA from the root path only — confirm ROOT_PATH_FALLBACK warning
• Manual: hit a domain with no AASA — confirm NOT_FOUND rendered cleanly
• Manual: toggle Android ↔ iOS rapidly — confirm result panel clears each switch and history shows correct platform badge

Out of scope (follow-up)

• Side-by-side Android+iOS pair view in Verification Deep Dive (the harder part of the original issue, intentionally split out)
• AASA signing / pkcs7-mime payload extraction
• webcredentials / appclips deep validation