feat(app): reach the blog from the Account hub via a themed Custom Tab (#88)

[Adron]

Closes #88. Part of epic #87.

A routing change only — no DTOs, no Room, no repository, no scraping. There is no public blog
JSON endpoint, and the epic rules scraping out.

What changed

• A Blog row in the Account hub menu, between "Search users" and "Sign out" — the bottom of the
  informational group, clear of the account actions. It carries an opens-outside-the-app affordance
  (OpenInNew + "Opens in a browser" content description).
• The Custom Tab's toolbar / secondary / navigation-bar colours come from the live
  MaterialTheme.colorScheme, and light/dark is chosen from the resolved surface colour. Because
  InterlinedListTheme has already resolved System/Light/Dark from ThemeSettingsStore, the tab
  follows the user's setting with zero new plumbing — :core:datastore was read but not
  modified, so there is no collision with Settings: theme preference synced to the account (theme) #36.
• Fallback chain: Custom Tab → plain ACTION_VIEW → BlogLaunchResult.UNAVAILABLE. It is
  deliberately free of Android types, so all three outcomes are covered by plain JVM tests.
• androidx.browser 1.8.0 added via the version catalog.

To carry the external-link affordance, the private AccountMenuRow gained a defaulted
trailingIcon/trailingContentDescription; all thirteen other rows are unchanged in behaviour.

The deep-link decision, and why it is a non-claim

https://interlinedlist.com/blog/... is deliberately NOT claimed. Only the app's own
interlinedlist://blog[/<slug>] scheme is registered. Three reasons:

1. With no in-app renderer, claiming the link means intercepting a browser-bound URL only to hand it
   straight back to a browser — the user pays an app launch and loses their own browser's
   session/state to arrive at the same page.
2. The no-Custom-Tabs fallback is a plain ACTION_VIEW on that same URL. If the app were a
   registered handler, that intent would resolve back into MainActivity — a ping-pong loop.
   Avoiding it would need an explicit package plus a <queries> block to enumerate browsers:
   complexity added solely to undo a claim that bought nothing.
3. autoVerify on /blog/* also ties the path to assetlinks.json upkeep for no gain.

BlogLink.webUrlFor still recognises and normalises the web form, so the manifest claim can be
switched on with no parser change once a real renderer exists. The rationale is recorded as a
manifest comment.

Verification

./gradlew :app:assembleDebug testDebugUnitTest → BUILD SUCCESSFUL. Repo-wide 1279 tests, 0
failures (20 new).

BlogLinkTest (14) covers the canonical index route, custom-scheme and web post links,
www/case/trailing-slash/query/fragment tolerance, percent-encoded slugs — and negatively: the
/blogroll and /blog-archive prefix traps, interlinedlist.com.evil.example, ../.
traversal, non-blog in-app links, garbage, empty and null. BlogLauncherTest (6) covers Custom Tab
used / browser untouched, fallback when no provider, no browser at all reporting failure instead of
crashing, a contained SecurityException, and dark/light selection against the real
ILSurfaceDark/ILSurfaceLight.

The merged manifest was checked to contain the interlinedlist://blog filter and not an https
blog filter.

Note

The Compose assertion for the menu row is compile-verified only, never executed (no emulator), so a
tag typo or hidden-node issue would not have been caught. It will be exercised the first time
instrumented tests run on a device.

A spec for the public GET /api/blog endpoint that would make real in-app rendering possible is
posted on epic #87.