fix(privacy): enforce secure proxied WebDAV transport

[mptfire]

Published as a draft for owner review. Local Android project validation remains blocked; do not merge until checks pass.

Finding: AMB-004 / Med. Branch: priv/amb-004-webdav-transport. Commit: fe498c27afe353cd77e682269386da4ec1f607fc.

Problem and threat model

A WebDAV server observes the user's direct IP even when Amber is configured for Tor because the dedicated client ignores the proxy. If the configured server uses HTTP, a network observer can read Basic-auth credentials. Backup private keys remain NIP-49 encrypted.

Source: WebDavService.kt:16; WebDavService.kt:51. Shared with pinned upstream master; no fork-only regression.

Fix

Use the selected shared HTTP transport, fail closed if Tor is selected without a SOCKS proxy, require HTTPS, and disable redirects.

User behavior and risk

HTTP WebDAV URLs are rejected. Tor-selected backups require a SOCKS-configured client. Redirecting servers must be configured using their final HTTPS endpoint.

Servers depending on HTTP or redirects stop working. The URL policy rejects embedded userinfo, query, and fragment; supply credentials through the existing settings fields.

Tests and validation

Added regression coverage:

• app/src/test/java/com/greenart7c3/nostrsigner/service/WebDavTransportPolicyTest.kt

WebDavTransportPolicyTest.kt was added; HTTPS/credential URL-policy cases passed in the portable harness. No live WebDAV, proxy, DNS, TLS, or redirect integration test was run.

git diff --check passes. Patch applies cleanly to upstream 43bb743f6523676c942bba1c0790a80294f53a86.

Attempted ./gradlew ktlintCheck test lint :app:assembleFreeRelease --no-daemon: blocked before tasks, AGP 9.3.2 plugin resolution fails. GitHub CI status is tracked on this draft PR. Project lint/tests/build must pass before merging. For Android instrumentation, run the connected free-debug tests with a device once a build is available.

Migration and release notes

No backup-format migration. Users of HTTP endpoints must move to HTTPS and update their configuration.

No version bump. Repository changelogs are version-based; add accepted user-visible behavior to the next release notes at release preparation.

[mptfire]

Reopening to trigger CI checks on the fork (Actions were not enabled when this draft was opened, so no checks have run yet).