fix: security hardening and resource leak fixes from multi-model review

[LandonMoran]

Summary

Continues the multi-model review (Gemini Pro, DeepSeek v4-pro, Gemini Flash) from PR #105 with remaining security hardening and resource leak fixes.

Security hardening

• TokenStore.kt: GitHub PAT now persisted in EncryptedSharedPreferences (AES-256-GCM) instead of plaintext SharedPreferences
• ModuleWebViewActivity.kt: JavaScript disabled unless module is both trusted AND web-network-allowed (was unconditionally enabled)
• ShellTutorialActivity.kt: temp script files (rish.dex, rish.sh) cleaned up in onDestroy to prevent info leak on storage
• CustomTabsHelper.java: added comment documenting URI fragment + query param ordering edge case

Resource leak / crash prevention

• CatalogScreen.kt: GitHub catalog list fetch moved to Dispatchers.IO (was blocking main thread inside LaunchedEffect)
• ModuleInstaller.kt: GitHub API JSON parsing wrapped in try/catch with fallback (was throwing on malformed responses)
• WatchdogManager.kt: close() now calls removeBinderReceivedListener / removeBinderDeadListener to prevent listener leak
• ShellTutorialActivity.kt: replaced runCatching sugar with explicit use {} for OutputStream, null-check createDocument result
• BackupRestoreUtil.kt: null-guard modulesRoot, fallback mkdirs + directory check, FileOutputStream(outFile).use {} instead of outputStream().use{}

Observability / correctness

• Logger.java: isLoggable now gates verbose/debug on BuildConfig.DEBUG || level <= Log.INFO (was always-on in release builds)
• ShizukuLocales.java: DISPLAY_LOCALES aligned to zh-CN/zh-TW (was mismatched zh-Hans/zh-Hant)

Test plan

• Verify compilation: ./gradlew :manager:compileDebugKotlin
• Verify TokenStore uses EncryptedSharedPreferences: grep -rn "EncryptedSharedPreferences" manager/src/main/java/moe/shizuku/manager/module/catalog/TokenStore.kt
• Verify ModuleWebView JS disabled for untrusted: grep "javaScriptEnabled" manager/src/main/java/moe/shizuku/manager/module/ModuleWebViewActivity.kt
• Verify CatalogScreen uses Dispatchers.IO: grep -n "Dispatchers.IO|withContext.*IO" manager/src/main/java/moe/shizuku/manager/module/catalog/CatalogScreen.kt
• Verify WatchdogManager close() cleanup: grep -n "removeBinderReceivedListener|removeBinderDeadListener" manager/src/main/java/moe/shizuku/manager/service/WatchdogManager.kt
• Verify Logger isLoggable: grep -A1 "isLoggable" manager/src/main/java/moe/shizuku/manager/utils/Logger.java
• Verify ShizukuLocales alignment: cat manager/src/main/java/rikka/shizuku/manager/ShizukuLocales.java
• Manual: install a module via catalog, verify token stored encrypted
• Manual: open untrusted module web UI, confirm JS is disabled

[github-actions]

🤖 AI Triage

Solid PR following up on multi-model review findings; the diff in WatchdogManager.kt and ShellBinderRequestHandler.kt correctly implements lifecycle cleanup and permission verification as described.

Note: this is an automated AI bot (Gemini); its verdict isn't 100% accurate and can be wrong. The bot doesn't read or reply to further comments in this thread — if it got this wrong, ping a human maintainer.

[kerneldroid]

Please revert the changes in ModuleWebViewActivity.kt.

Disabling javaScriptEnabled completely breaks the module WebUI system and the
window.Shizuku JS bridge. Module WebUIs are designed to run local JavaScript in
an offline sandbox. Requiring trusted && web-network-allowed just to enable JS
renders all standard offline module interfaces non-functional.

The rest of the PR (security leaks, EncryptedSharedPreferences, Dispatchers.IO)
is fine, but the WebView change is a critical regression.

[kerneldroid]

Also revert the changes in ShellTutorialActivity.kt. Calling contentResolver.delete() on rishFileUri and dexFileUri in onDestroy() completely breaks rish setup — it immediately erases the exported binaries as soon as the user exits the tutorial activity to use them in Termux.