feat(android): buddies floater parity (SYSTEM_ALERT_WINDOW overlay)

[itsdestin]

Background

Deferred from the buddies floater MVP (desktop-only). See design spec: docs/superpowers/specs/2026-04-17-buddies-floater-design.md §10.

The remote-shim.ts currently stubs window.claude.buddy.* with errors that say "Buddy is desktop-only in this version" — this issue delivers the Android counterpart.

Acceptance criteria

• User grants SYSTEM_ALERT_WINDOW permission via Android Settings (cannot be auto-granted). App must guide user through the permission flow on first enable.
• Kotlin WindowManager overlay hosts a small WebView rendering the buddy mascot at 80×80dp.
• Second WindowManager overlay hosts the chat WebView (320×480dp) triggered by mascot click.
• Integrate with SessionService.handleBridgeMessage() — new message types matching desktop's buddy:* IPC: show, hide, toggle-chat, set-session, subscribe, unsubscribe, get-viewed-session.
• Bootstrap work to deploy the overlay service component.
• Position persistence via existing preferences storage.
• remote-shim.ts buddy stubs replaced with real implementations using the same message protocol.

Risks

• SYSTEM_ALERT_WINDOW is a sensitive permission — Google Play may scrutinize. Document the use case in Play Console.
• Dark patterns concern: make the mascot easy to dismiss; don't block any other UI.