[bardesss]

Fixes from a full review of the repo, plus a list bug and two UI changes from device testing.

Security and CI

• ci.yml actions are pinned to commit SHAs, with the version in a comment on the same line.
• release.yml no longer uses the Gradle cache (cache-disabled: true), so the signed build never consumes a cache another workflow wrote.
• The release build runs testDebugUnitTest and lintDebug before signing, in a step without the signing secrets.
• A dry run uploads its artifact as dry-run-wick-<tag>.
• Dependabot's github-actions PRs get the [skip release] prefix.
• Login rejects http:// addresses with its own message. A cleartext refusal (UnknownServiceException) is reported as such instead of "Is your VPN on?".
• FaviconAuth also checks the scheme before adding the key.
• Icon URLs are limited to http and https.
• The API key field is no longer kept in saved instance state.
• dataExtractionRules exclude the datastore and the database from cloud backup and device transfer.

State bugs

• The edit token is cached together with the Auth it was fetched for, and is dropped when the account changes.
• OkHttp calls are cancelled when their coroutine is cancelled, and the client has a 5 minute callTimeout. A sign out on a dead VPN no longer waits for the socket timeouts.
• signingOut lives in AppContainer. It lasts through a rotation, but process death no longer restores a blank screen.
• upsertKeepingLocal treats items covered by a pending mark-all like items with a pending mark, so a failed mark-all no longer brings rows back as unread under a 0 count.
• Both DataStores have a ReplaceFileCorruptionHandler.
• A new list after a refresh leaves out items that are read locally but not yet on the server. Prune and markMissingRead still use the full server id set. The refresh waits for applied marks first.
• A 2xx login answer without Auth= counts as no Google Reader API, and 403 is mapped the same way everywhere.

Consistency and accessibility

• User facing messages and ages come from string and plural resources. The views expose error types instead of strings.
• Shared constants and known API paths are defined once, and the two v0.1.0 migrations share one format constant and helper.
• AccountSwitch and wipeAccount move out of the settings UI package.
• TalkBack:
  • rows announce read or unread
  • ages are read in long form
  • the hidden pill is out of the tree
  • login errors are a live region
  • headings are marked
  • the wordmark reads as "Wick"

Dead code

• htmlUrl is removed from the entity, the DTOs and the model. Room goes to schema 2 with an AutoMigration and @DeleteColumn, so the pending marks queue survives. 2.json is exported and a migration test covers it.
• Also removed: unused DAO queries, WickColors.Core, CategoryDto.id, OriginDto.htmlUrl, an unused import, and the duplicate fallback in openLink.
• Test-only APIs are made private or internal.

UI

• The drawer shows the wordmark above "All unread".
• Settings are one row each:
  • switches for hiding empty feeds, summary images and haptics
  • two-segment controls for sort order and link target
• The settings title sits where the list header title does, and every settings row is the same height.

README

• The feature list is written as plain sentences.
• Server examples are generic.
• A note says the API key travels as a query string for favicons, so it appears in your own server's access logs.

Not in this PR

• The baseline profile has to be generated on a device.
• The settings and session storage split was skipped, to avoid a data migration.

Tests

235 unit tests, lint and assembleRelease pass. Only the drawer and settings snapshots changed.