feat: Add WordPress.com OAuth support to iOS and Android demo apps

[jkmassel]

What?

Add WordPress.com OAuth2 authentication support to both the Android and iOS demo apps, alongside the existing Application Passwords flow for self-hosted sites.

Why?

The demo apps previously only supported self-hosted WordPress sites via Application Passwords. This made testing WordPress.com sites an integration concerns in other apps, which means it's not getting tested as much as it needs to. This PR adds OAuth2 support so the apps can also connect to WordPress.com sites, and upgrades credential storage to use encrypted repositories on both platforms.

How?

Android

• Branch on DiscoveredAuthenticationMechanism to launch the appropriate auth flow (Application Passwords or OAuth2)
• Store WP.com accounts as Account.WpCom so auth type is determined by pattern matching
• Replace SharedPreferences with encrypted AccountRepository from wordpress-rs, backed by Android Keystore
• Add WP.com site namespace handling in SitePreparationViewModel

iOS

• Add AuthenticationManager with async/throws API supporting both Application Passwords and OAuth2 flows
• Replace UserDefaults-based ConfigurationStorage with encrypted AccountRepository from wordpress-rs (SecureEnclavePasswordTransformer)
• Use WpComDotOrgApiUrlResolver for correct WP.com API URL routing
• Propagate errors from ConfigurationStorage instead of swallowing them

Shared (JS/Web)

• Replace fetch-based editor asset loading with config injection via window.GBKit.editorAssets. (We have the data already, so why download it again?)
• Guard against duplicate site namespace insertion in the API path modifier middleware
• Move shared WP.com OAuth credentials file to project root, referenced by both platforms

Testing Instructions

1. Self-hosted (Android or iOS): Tap "Add WordPress site", enter a self-hosted site URL → Application Passwords flow → verify editor loads
2. WordPress.com (Android or iOS): Copy wp_com_oauth_credentials.json.example to wp_com_oauth_credentials.json in the project root, fill in client_id/secret → enter a WP.com site URL → OAuth browser flow → verify editor loads with plugins and theme styles
3. Verify sites persist across app restarts
4. Verify site deletion works (iOS: swipe to delete, Android: long-press)
5. In a WP.com site – try adding an AI block and asking it to make you a haiku. Do the same with a Jetpack site. This validates third-party plugin support and the ability for the editor to make authenticated requests to the remote site.
6. In a self-hosted site (you can use vanilla.wpmt.co) load the editor and ensure that theme styles are loaded. This validates remote theme style loading.

🤖 Generated with Claude Code

[jkmassel]

This will need to be updated to a trunk revision prior to merging