038c6036fe
- Pinned-root network security config (D-082) is now a template in app/src/releasePinnedRoot/; with kvitt.tls.pinnedRoot=true the task generatePinnedRootNetworkSecurityConfig writes it into the release resources with the domain kvitt.publicHost (D-121), and stops with a clear message while the root src/release/res/raw/kvitt_root_ca.crt is not committed (fallback unprepared, SPEC 10.5.3). Comment: pinned NPM root (D-120). - Port 443 (D-124): RELEASE_SERVER_URL is https://<kvitt.publicHost> without a port (RELEASE_SERVER_PORT removed); the AC-2.6 intent filter has no android:port; InviteLink drops an explicit default port. - S-1 fixture GOLDEN_SERVER https://kvitt.example.org; 28 S-1 goldens re-recorded (only the server row changed). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B