fix: gate login methods by server availability

[mkaltner]

Summary

• gate OIDC on the server's explicit enabled/configured state while retaining password fallback
• gate Passkey login on both the SDK availability result and validated mobile bridge manifest
• treat typed ArcaneError.NotFound as the Arcane 2.12+ compatibility fallback, and fail closed for other availability errors
• isolate OIDC and Passkey probes, synchronously invalidate stale state on server/client/logout transitions, and preserve authenticated Passkeys/MFA management
• document the approved Android/iOS deviation, compared revisions, compatibility evidence, and AVD validation

No libarcane-kotlin change is required; the existing typed passkeys.loginAvailability() API and SDK error model cover this correction.

Compatibility evidence

• Compared Android 5d07cd0d3ba2925647687dafdc7b47e548ae2180, iOS 8d13fdb5cd61a62b1d666e9e982a2670d86086c3, libarcane-kotlin b29695d547b78389ed7230b35cd133f7046b4b52, and Arcane 5ac6d89756f80d22cf4f057865497cb9a8cf061d.
• Read-only public Arcane 2.11.1 checks returned a valid v2 bridge manifest and available:false; the API 30 AVD showed password login only with no Passkey or OIDC action, including after force-stop/reopen. The public server was not mutated.
• An isolated exact Arcane v2.12.0 image showed configured OIDC plus the password fallback and hid Passkey for available:false. The published image still served the availability route despite the pinned tag source omitting it, so the typed 404 path is covered deterministically.
• Switching to the OIDC-disabled disposable Arcane 2.10.2 target cleared both optional actions; password login succeeded. Force-stop/reopen and back/reopen restored Dashboard without a login/content flash.
• All temporary AVD, LXD, proxy, certificate, container, volume, image, and package resources were removed after validation.

Tests

• ./gradlew :app:testDebugUnitTest :app:assembleDebug — 392 tests, 67 suites, zero failures/errors/skips
• ./gradlew :app:lintDebug — no new findings (checked-in baseline unchanged)
• git diff --check
• focused deterministic coverage for true/false/404/error/cancellation, bridge absence, OIDC isolation, stale generations, loading visibility, and password fallback

Automated reviews are inactive; the staged diff received an independent focused self-review after the full validation run.