Complete close-parity maintenance handoff

[mkaltner]

Outcome

Completes the bounded Android close-parity and maintenance-handoff batch without claiming full iOS or Arcane administration-console parity.

• makes local password, OIDC, and passkey login availability independent and server-truthful
• consumes server access surfaces for navigation, Settings, restored/deep-linked routes, shortcuts, dashboard callbacks, and relevant mutations
• reconciles editable System Settings with current Arcane keys, types, options, conditions, ranges, and per-environment targeting
• adds supported standalone-container create, edit/recreate, commit-to-image, and Compose-to-project workflows on Arcane 2.10+
• refreshes parity, readiness, and maintenance documentation and links deferred expansion to Optional Android-native and future product expansion #62–Saved server profiles and redacted diagnostics #65

SDK dependency

Requires libarcane-kotlin PR getarcaneapp/libarcane-kotlin#12, now merged into SDK main as 5546f35ba5dcc3ca0b378ddd1101a1d97f690c03.

Review corrections

The final independent diff review additionally fixed:

• transient permissions-manifest failures no longer fall into the permissive old-server path
• server-authorized custom roles are no longer blocked by legacy isAdmin prefilters
• container management is gated at Arcane 2.10.0, matching the route introduction history
• memory/CPU overflow is rejected before container mutation

Verification

• libarcane-kotlin: ./gradlew :arcane-core:test :arcane-android:assembleRelease
• ./gradlew :app:testDebugUnitTest :app:assembleDebug
• ./gradlew :app:lintDebug — no new issues; existing baseline filters 45 errors and 1 hint
• git diff --check
• clean isolated checkout of pushed Android head 26c24798117a18941a5be41fbf51c52ee2ba3a9b with -Parcane.remoteSdk

API 30 plus disposable Arcane 2.10.2 covered password enabled/disabled, OIDC disabled, passkey false, loading/restoration, admin and restricted roles, permission loss/process recreation, stale deep-link rejection, System Settings read/write/restore, and container create/recreate/commit/Compose/project flows with failure and cleanup evidence.

Not claimed as completed: enabled-provider OIDC, provider-completed WebAuthn, live current-Arcane, multi-environment permission transitions, or every UI cancellation/failure lane.

Scope

No container rename is exposed because current Arcane has no authoritative route. Deferred GitHub issues #62–#65 are documented and not implemented here. No release, tag, signing, or merge action is included.