fix: gate local-network access for Android 17 (Local Network Protections)

[emir-hasanbegovic]

What

On Android 17 (API 37 — our targetSdk/compileSdk) the app couldn't reach satellites: scanning popped a system "Choose a device to connect" picker, and a returning user's remembered satellite silently failed to reconnect. This restores normal connectivity behind a single one-time permission prompt.

Why

Android 17 enforces Local Network Protections: mDNS/UDP/raw-socket LAN access is blocked until the user grants ACCESS_LOCAL_NETWORK. The app neither declared nor requested it, so:

• Discovery (mDNS via NsdManager) fell back to the OS per-device picker.
• Auto-reconnect (autoReconnectAll(), fired from a process-lifecycle observer on app foreground) and any direct socket connect failed with EPERM — no picker, no prompt, silent.

We take the blanket-permission path rather than the NsdManager FLAG_SHOW_PICKER path, because local-network access is spread across discovery, UDP streaming, direct connect-by-IP, manual add, and reconnect; the picker would only bless picker-obtained addresses.

How

Core

• Declare ACCESS_LOCAL_NETWORK in the manifest.
• New LocalNetworkAccess helper: one place for the API-37 gate + permission string; a no-op on older OSes (implicit LAN access via INTERNET). sdkInt is injectable for tests.

Request at each entry point that first needs the network

• MainActivity (launcher): on first resume, if a remembered satellite exists and the permission is missing, prompt up front — so returning users reconnect from the home screen instead of failing silently. Grant → autoReconnectAll(); deny → a notification pointing to Connections.
• ConnectionsActivity: request on the first scan when entering; deny → a persistent banner that opens app settings; self-heals on return once granted.
• SetupConnectionActivity: request before the scan via a pending-resume callback (mirrors onDiscoverableResult), so a pre-grant blocked scan can't shadow the real one through the manager's single-flight guard; deny → the setup error dialog.

Gate the automatic path

• SatelliteConnectionManager.connect(): refuse any non-user-initiated connect (auto-reconnect + death-retries) until the permission is granted — a lifecycle observer can't itself request a permission, so this kills the silent EPERM until an Activity has prompted. Streaming on the overlays is covered transitively: no grant → no connection → nothing to stream.

i18n

• Translations for the 3 new strings across bs/de/es/fr/pt-rBR (MissingTranslation is a lint error in this project).

Resulting flow (Android 17+)

• Returning user w/ remembered satellite: open app → one-time "Allow Dish to find and connect to devices on your local network?" on the home screen → grant → auto-reconnects. Deny → notification → Connections.
• New user: Setup → Satellite card → prompt → scan/pair as before.
• Connections: prompts on entry for the scan; no more OS device-picker.
• One app-global permission: grant once anywhere, granted everywhere; no per-screen re-prompts.
• Older OSes: unaffected — the gate short-circuits.

Tests

• LocalNetworkAccessTest (JUnit4 + MockK): enforcement boundary at API 37, pre-enforcement granted without touching the permission, granted/denied on an enforcing OS.
• SatelliteConnectionManagerTest: new case — an AUTO_RECONNECT is refused before any handshake or socket when local-network access is missing.

Verification

Local, all green: compileDebugKotlin, ktlintCheck, detekt, lintDebug, testDebugUnitTest.

⚠️ Enforcement is device-side on Android 17+; older OSes short-circuit. Not yet exercised on a live API-37 device — the launch-time prompt, deny→notification, and grant-from-settings paths are worth a manual smoke test on an emulator/device before merge.