fix(discord): streamline mobile direct auth, polish TV QR pairing, and secure OAuth flow

[Himanth-reddy]

Summary of Changes

This pull request overhauls and polishes the Discord Rich Presence authentication and UI flows for both Mobile and Android TV.

---

1. Mobile Direct Auth (0ms Delay)

• Eliminated Unnecessary Cloud Pairing Round-Trip: On non-TV / touch devices, tapping "Connect" now immediately generates local PKCE tokens and launches the browser OAuth authorization page directly. This eliminates the previous 2-second cloud pairing session initialization delay.
• Deep Link Return: Upon authorizing in the browser, auth.arvio.tv/discord/callback triggers arvio://discord/auth?code=...&state=... to return directly to the app and finish authentication instantly.
• Dedicated Vector Asset (ic_discord.xml): Added a clean Discord vector icon using android:fillType="evenOdd" and strict space-separated arc commands, fixing eye-cutout distortion on physical Android devices.

---

2. TV Experience: Pure QR Pairing Card

• Removed Simulated Pointer & In-App WebView:
  • Why removed: The simulated pointer inside an embedded WebView had inaccessible toolbar controls on Android TV remote D-pads and created a clumsy user experience.
  • What was added: Replaced with a pure, focused TV QR code pairing card. Users simply scan the QR code using their phone camera to approve authorization.
• Removed Redundant Cancel Button:
  • Why removed: On Android TV, dialogs are standardly dismissed using the remote Back / Escape keys. Removing the button avoids focus trapping and gives the modal a balanced, centered layout.
• Pointer Event Isolation: Dialog panel explicitly consumes tap gestures to prevent taps from bubbling to the background scrim.

---

3. Security & OAuth Hardening

• Independent Cryptographic state Verification: Generated an independent cryptographically random OAuth state stored under KEY_OAUTH_STATE in private app preferences, distinct from the PKCE code challenge. On deep link return, the callback state is compared against KEY_OAUTH_STATE to protect against CSRF.
• Netlify Callback Logic Consolidation (callback.js): Extracted shared callback logic into callback.js to prevent code drift between /discord/callback.html and /discord/callback/index.html.
• Safe DOM Element Creation: Replaced innerHTML link string concatenation with DOM nodes created via document.createElement('a') and textContent.
• QR Code Error Handling: Catch Exception instead of Throwable in QrCodeImage so critical VM errors (OutOfMemoryError) propagate, with error logging.

---

4. Localization & Documentation

• String Resource Extraction: Extracted all Discord activation modal titles, descriptions, status messages, and instructions into strings.xml.
• Privacy Policy Update (PRIVACY.md): Updated §8 (Your Rights) to explicitly list Discord disconnection alongside Trakt.

---

Verification

• Automated Tests: All 35 tests in netlify-auth-site/tests passed (node --test tests/*.test.js).
• Android Compilation: Gradle assembleSideloadDebug succeeded with zero errors.
• Device Verification: Installed and verified on physical Motorola phone and Android TV emulator (emulator-5554).