fix: Android security hardening + resource leak fixes

[juliosuas]

Changes

1. Replace usesCleartextTraffic=true with network security config

AndroidManifest.xml had android:usesCleartextTraffic="true", allowing all HTTP traffic in plaintext. Replaced with a network_security_config.xml that only permits cleartext for local network addresses (localhost, 10.x, 192.168.x, 172.16.x) where the OpenClaw gateway typically runs.

2. Fix Timer thread leak in GeminiLiveService

Calling connect() multiple times created new Timer objects without cancelling previous ones. Now cancels the existing timer before creating a new one.

3. Fix sendExecutor thread leak

sendExecutor (SingleThreadExecutor) was never shut down in disconnect(). Added shutdownNow() call.

4. Fix WebRTCClient NPE crash

videoSource!! force-unwrap replaced with safe null check (val source = videoSource ?: return).

Files Changed

• AndroidManifest.xml — network security config reference
• res/xml/network_security_config.xml — new, cleartext only for LAN
• gemini/GeminiLiveService.kt — timer + executor fixes
• webrtc/WebRTCClient.kt — null safety fix

Test plan

• App connects to OpenClaw on local network (HTTP still works for LAN)
• App fails gracefully for cleartext to public URLs
• Repeated connect/disconnect doesn't leak threads
• WebRTC works when videoSource is valid, doesn't crash when null

🤖 Generated with Claude Code