v0.12.0-kmb.15 — remove allowFileAccessFromFileURLs and four dead WebSettings

Subtraction only. Five setters removed from BrowserActivityNative.configureWebSettings; nothing added, no behaviour change.

The security one — allowFileAccessFromFileURLs = true

Deprecated since API 30, still functional on the panel's API 31. It lets JavaScript running from a file:// origin read other file:// URLs; the default has been false since API 16.

It was inert here — but not for the reason a quick grep suggests. The app does load local content: InternalWebClient.onReceivedError loads file:///android_asset/error_page.html on any network error. That page contains zero <script> — a stylesheet <link>, an <img> and static text, all markup subresources that load regardless of this setting, which gates only JS-initiated cross-file:// reads. No JavaScript ever executes from a file:// origin anywhere in the app.

allowUniversalAccessFromFileURLs, the genuinely dangerous sibling, is not set anywhere in this codebase.

Added in 3866f04 (Aug 2018) alongside READ/WRITE_EXTERNAL_STORAGE for "access local files" — those permissions are long gone from the manifest, so the motivation died before the setting did.

Four dead setters

pluginState (NPAPI, gone from WebView), setRenderPriority (ignored by the Chromium renderer), saveFormData (no-op from API 26 on; minSdk is 26), databaseEnabled (WebSQL — dead for this app: Home Assistant uses IndexedDB/localStorage, not openDatabase()). Deprecation warnings in that file: 5 → 0.

javaScriptEnabled and domStorageEnabled are load-bearing and untouched, as is the val webSettings = webView.settings local-val pattern from the kmb.5 renderer-crash fix.

Verification

Beyond the usual bar, since this touches the function the kmb.5 fix lives in: build + unit tests + lintVital green, smoke-device.sh PASS, panel-render-probe.sh RENDERING, code-reviewer found no defects, and — attended — smoke-renderer-crash.sh PASS (app pid held, focus held, fresh renderer bound, dashboard rendering after the injected crash). Dashboard confirmed interactive by hand.