feat(android-demo): scaffold Sketchfab API client (search + download + LRU cache)

Mirrors the iOS scaffold (918faac). Same architecture: streaming on-demand from
api.sketchfab.com instead of bundling ~100 MB of GLB / USDZ in the APK.

New files under samples/android-demo/src/main/.../sketchfab/:
- SketchfabConfig.kt: BuildConfig-backed API key + cache dir constants
- SketchfabModels.kt: Codable types for /v3/search and /v3/models/<uid>/download
- SketchfabService.kt: singleton with search() / featured() / downloadUrl() /
  downloadModel(); OkHttp + kotlinx-serialization; on-disk LRU cache in
  context.cacheDir/sketchfab capped at 500 MB
- (test) SketchfabServiceTest.kt: offline URL-path + missing-key tests

build.gradle wiring follows the existing ARCORE_API_KEY pattern:
  1. SKETCHFAB_API_KEY env var (CI, store builds — supplied via GitHub Secret)
  2. local.properties → sketchfab.api.key (developer machines — gitignored)
  Result is injected into BuildConfig.SKETCHFAB_API_KEY. When neither source
  has a value, the gallery falls back to bundled featured models and disables
  Sketchfab search at runtime (SketchfabError.MissingApiKey).

Deps added in gradle/libs.versions.toml:
- okhttp 5.x
- kotlinx-serialization-json 1.8.x
- kotlin-plugin-serialization

build-apks.yml already updated in commit 7858051 to forward
secrets.SKETCHFAB_API_KEY to the Gradle build.

Build verified: ./gradlew :samples:android-demo:compileDebugKotlin SUCCESSFUL.

TODO V1.1: route through the mcp-gateway proxy so the master key isn't shipped
inside the APK (extractable by any user with `apktool`). The proxy holds the
real key server-side and authenticates the demo app via a short-lived token.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Thomas Gorisse

gradle/libs.versions.toml

@@ -25,6 +25,8 @@ arCore = "1.53.0"
 
 # Networking
 fuel = "2.3.1"
+okhttp = "5.0.0"
+kotlinxSerialization = "1.8.0"
 
 # UI
 googleMaterial = "1.13.0"
@@ -92,6 +94,12 @@ fuel = { group = "com.github.kittinunf.fuel", name = "fuel", version.ref = "fuel
 fuel-android = { group = "com.github.kittinunf.fuel", name = "fuel-android", version.ref = "fuel" }
 fuel-coroutines = { group = "com.github.kittinunf.fuel", name = "fuel-coroutines", version.ref = "fuel" }
 
+# OkHttp (HTTP client used by Sketchfab service in android-demo)
+okhttp = { group = "com.squareup.okhttp3", name = "okhttp", version.ref = "okhttp" }
+
+# Kotlinx Serialization (JSON parsing for Sketchfab API responses)
+kotlinx-serialization-json = { group = "org.jetbrains.kotlinx", name = "kotlinx-serialization-json", version.ref = "kotlinxSerialization" }
+
 # Material
 google-material = { group = "com.google.android.material", name = "material", version.ref = "googleMaterial" }
 
@@ -133,6 +141,7 @@ android-library = { id = "com.android.library", version.ref = "agp" }
 kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
 kotlin-multiplatform = { id = "org.jetbrains.kotlin.multiplatform", version.ref = "kotlin" }
 compose-compiler = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
+kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
 compose-multiplatform = { id = "org.jetbrains.compose", version.ref = "composeMultiplatform" }
 publish = { id = "com.vanniktech.maven.publish", version.ref = "mavenPublish" }
 dokka = { id = "org.jetbrains.dokka", version.ref = "dokka" }

samples/android-demo/build.gradle

@@ -2,6 +2,7 @@ plugins {
     alias(libs.plugins.android.application)
     alias(libs.plugins.kotlin.android)
     alias(libs.plugins.compose.compiler)
+    alias(libs.plugins.kotlin.serialization)
     alias(libs.plugins.roborazzi)
 }
 
@@ -37,6 +38,27 @@ android {
             }
         }
         manifestPlaceholders["arcoreApiKey"] = arcoreApiKey
+
+        // Inject the Sketchfab API key into BuildConfig so the demo's
+        // SketchfabService can authenticate against api.sketchfab.com without
+        // hard-coding a token in source. The key is read from one of:
+        //   1. SKETCHFAB_API_KEY environment variable (CI / store builds)
+        //   2. local.properties → sketchfab.api.key (developer machines)
+        //   3. fallback empty string (Sketchfab features stay disabled —
+        //      SketchfabConfig.apiKey returns null and the service throws
+        //      MissingApiKey).
+        // TODO V1.1: route requests via the mcp-gateway proxy so end-users
+        // never see the master key in the APK. See SketchfabConfig.kt.
+        def sketchfabApiKey = System.getenv("SKETCHFAB_API_KEY") ?: ""
+        if (sketchfabApiKey.isEmpty()) {
+            def localPropsFile = rootProject.file("local.properties")
+            if (localPropsFile.exists()) {
+                def localProps = new Properties()
+                localPropsFile.withInputStream { localProps.load(it) }
+                sketchfabApiKey = localProps.getProperty("sketchfab.api.key", "")
+            }
+        }
+        buildConfigField "String", "SKETCHFAB_API_KEY", "\"${sketchfabApiKey}\""
     }
 
     signingConfigs {
@@ -117,6 +139,12 @@ dependencies {
     implementation libs.play.app.update
     implementation libs.play.app.update.ktx
 
+    // Sketchfab API client — OkHttp for network, kotlinx-serialization for JSON.
+    // Used by io.github.sceneview.demo.sketchfab.SketchfabService to stream
+    // models from api.sketchfab.com instead of bundling GLBs in the APK.
+    implementation libs.okhttp
+    implementation libs.kotlinx.serialization.json
+
     // Google Fused Location Provider — required by ARCore Geospatial mode
     // (Config.GeospatialMode.ENABLED) used by ARStreetscapeDemo. Without this
     // dependency on the classpath, Session.configure() throws an

samples/android-demo/src/main/java/io/github/sceneview/demo/sketchfab/SketchfabConfig.kt

@@ -0,0 +1,44 @@
+package io.github.sceneview.demo.sketchfab
+
+import io.github.sceneview.demo.BuildConfig
+
+/**
+ * Configuration for the Sketchfab Data API v3.
+ *
+ * The API key is injected at build time via [BuildConfig.SKETCHFAB_API_KEY]
+ * (populated from the `SKETCHFAB_API_KEY` environment variable or the
+ * `sketchfab.api.key` property in `local.properties` — see this module's
+ * `build.gradle`). A `SKETCHFAB_API_KEY` env variable at runtime is also
+ * checked as a last-resort fallback (useful when running unit tests from a
+ * shell that exports the variable but doesn't propagate it to Gradle).
+ *
+ * TODO V1.1: move to backend proxy via mcp-gateway to avoid bundling the key
+ * directly in the Android app binary. End-users should authenticate against
+ * the proxy (which holds the master key server-side) so we don't ship a
+ * long-lived token that can be extracted from `.apk` files.
+ */
+object SketchfabConfig {
+
+    /** Base URL of the Sketchfab Data API v3. Always ends with a trailing slash. */
+    const val BASE_URL: String = "https://api.sketchfab.com/v3/"
+
+    /**
+     * API key injected at build time, or `null` when missing.
+     *
+     * Callers should surface [SketchfabService.SketchfabError.MissingApiKey]
+     * in that case rather than firing unauthenticated requests.
+     */
+    val apiKey: String?
+        get() {
+            val fromBuildConfig = BuildConfig.SKETCHFAB_API_KEY
+            if (fromBuildConfig.isNotBlank()) return fromBuildConfig
+            val fromEnv = System.getenv("SKETCHFAB_API_KEY")
+            return fromEnv?.takeIf { it.isNotBlank() }
+        }
+
+    /** Subdirectory under `Context.cacheDir` where downloaded GLB files live. */
+    const val CACHE_DIR_NAME: String = "sketchfab"
+
+    /** Maximum cache size on disk, in bytes (500 MB). */
+    const val CACHE_MAX_BYTES: Long = 500L * 1024 * 1024
+}

samples/android-demo/src/main/java/io/github/sceneview/demo/sketchfab/SketchfabModels.kt

@@ -0,0 +1,80 @@
+package io.github.sceneview.demo.sketchfab
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/**
+ * A Sketchfab model entry returned by `/v3/search` and `/v3/models`.
+ *
+ * Fields mirror the iOS scaffold (`SketchfabModels.swift`) so both demo apps
+ * speak the same wire format — keep them in sync when adding properties.
+ */
+@Serializable
+data class SketchfabModel(
+    val uid: String,
+    val name: String,
+    val description: String? = null,
+    val thumbnails: SketchfabThumbnails,
+    @SerialName("viewerUrl") val viewerUrl: String,
+    val downloadable: Boolean = false,
+    val tags: List<SketchfabTag>? = null,
+)
+
+/** Wrapper around the `images` array returned by Sketchfab for each model. */
+@Serializable
+data class SketchfabThumbnails(
+    val images: List<SketchfabThumbnail>,
+)
+
+/** A single thumbnail at a specific resolution. */
+@Serializable
+data class SketchfabThumbnail(
+    val url: String,
+    val width: Int,
+    val height: Int,
+)
+
+/**
+ * A tag attached to a model. Sketchfab returns more fields (slug, uri, …) but
+ * only [name] is needed for filtering/display in the demo app.
+ */
+@Serializable
+data class SketchfabTag(
+    val name: String,
+)
+
+/** Paginated search/list response. */
+@Serializable
+data class SketchfabSearchResponse(
+    val results: List<SketchfabModel>,
+    val next: String? = null,
+    val previous: String? = null,
+)
+
+/**
+ * Response of `GET /v3/models/{uid}/download`.
+ *
+ * Sketchfab returns up to three format entries (`gltf`, `glb`, `usdz`); all
+ * are optional because availability depends on the model. The demo prefers
+ * `glb` (single binary, no companion files) and falls back to `gltf`, then
+ * `usdz` as a last resort (which SceneView can't load on Android — useful
+ * only for cross-platform parity reporting).
+ */
+@Serializable
+data class SketchfabDownloadResponse(
+    val gltf: SketchfabDownloadUrl? = null,
+    val glb: SketchfabDownloadUrl? = null,
+    val usdz: SketchfabDownloadUrl? = null,
+) {
+    /** Best format for SceneView consumption. */
+    val preferred: SketchfabDownloadUrl?
+        get() = glb ?: gltf ?: usdz
+}
+
+/** A signed download URL with its size and expiration timestamp (epoch seconds). */
+@Serializable
+data class SketchfabDownloadUrl(
+    val url: String,
+    val size: Long,
+    val expires: Long,
+)