Android CI build + delete-chat (self-only) + SFU copy refresh

- codemagic.yaml: add an Android workflow that builds an installable debug
  APK (Linux instance, no signing needed to test) — the Android equivalent of
  the iOS TestFlight loop. mobile/scripts/android-patch.js injects the
  camera/mic/notification permissions into the CI-generated manifest (android/
  is gitignored, same as ios/).
- Delete chat (self-only): new POST /api/messages/clear bulk-hides a whole DM
  (or group) for the requester via the existing per-user message_hidden
  mechanism — the other party keeps their copy entirely. "Delete chat" button
  added to the DM contact-info panel; chat-cleared synced to my other devices.
  Verified end-to-end on Postgres (A clears -> empty for A, B untouched).
- Meetings copy: SFU is live, so drop the "coming soon" / "small group (mesh)"
  wording on the welcome card and the Meetings header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codemagic.yaml

@@ -165,3 +165,76 @@ workflows:
         # submit_to_app_store: false
     # No email recipients here on purpose — build status is watched on the Codemagic dashboard. Add
     # per-user notifications in the Codemagic UI (or a `publishing.email` block) later if you want them.
+
+  # ── Android test build ──────────────────────────────────────────────────────────────────────────
+  # Builds an INSTALLABLE debug APK of the same Capacitor shell (loads https://remote.bizgaze.com). This is
+  # the Android equivalent of the iOS TestFlight loop, but simpler — no Google Play account or signing is
+  # needed to test: download the APK artifact from the Codemagic build page (or wire an email/Slack in the
+  # UI), sideload it on a phone (enable "Install unknown apps"), and run.
+  #
+  # Runs on a Linux instance (has the Android SDK + JDK preinstalled) — much cheaper/faster than a Mac.
+  #
+  # Firebase push (FCM) is OPTIONAL for this test build: app/build.gradle only applies the google-services
+  # plugin when google-services.json is present, so the APK builds fine WITHOUT it (push/call-wake just
+  # won't fire). To enable push, base64 the google-services.json and store it as a secure Codemagic env var
+  # GOOGLE_SERVICES_JSON (group `android_config`); the step below decodes it into place.
+  android-apk:
+    name: Biz Connect Android → test APK
+    max_build_duration: 45
+    instance_type: linux_x2
+    environment:
+      # To enable FCM push later, create a Codemagic variable group holding GOOGLE_SERVICES_JSON (base64 of
+      # google-services.json, marked secure) and uncomment the two lines below. Left out for now so the first
+      # test build needs ZERO Codemagic setup.
+      # groups:
+      #   - android_config
+      vars:
+        PACKAGE_NAME: "com.bizgaze.connect"
+      node: 22
+      java: 17
+    scripts:
+      - name: Install JS dependencies
+        script: |
+          cd mobile
+          npm install
+
+      - name: Generate the Android project (Capacitor)
+        script: |
+          cd mobile
+          # `cap add android` scaffolds android/; safe to re-run — it no-ops if it already exists (our committed
+          # project has custom manifest permissions, which cap sync preserves).
+          if [ ! -d "android" ]; then npx cap add android; fi
+          npx cap sync android
+          # App icon + splash from resources/icon.png & resources/splash*.png.
+          npx capacitor-assets generate --android || echo "capacitor-assets returned non-zero (see above)"
+          # The generated project points sdk.dir at wherever it was made; overwrite it with the CI SDK path
+          # (Codemagic exports ANDROID_SDK_ROOT) so Gradle finds the SDK.
+          echo "sdk.dir=$ANDROID_SDK_ROOT" > android/local.properties
+          echo "Android SDK -> $ANDROID_SDK_ROOT"
+          # android/ is gitignored and regenerated fresh in CI, so its manifest only has INTERNET. Inject the
+          # camera/mic/notification permissions the web UI needs (mirrors ios-patch.sh for iOS). Tolerant + idempotent.
+          node scripts/android-patch.js android/app/src/main/AndroidManifest.xml
+
+      - name: (Optional) Firebase google-services.json for FCM push
+        script: |
+          cd mobile/android/app
+          if [ -n "$GOOGLE_SERVICES_JSON" ]; then
+            echo "$GOOGLE_SERVICES_JSON" | base64 --decode > google-services.json
+            echo "google-services.json written — FCM push enabled in this build"
+          else
+            echo "No GOOGLE_SERVICES_JSON set — building WITHOUT FCM push (fine for a shell/UI test build)"
+          fi
+
+      - name: Build the debug APK
+        script: |
+          cd mobile/android
+          chmod +x ./gradlew
+          # Debug build type is auto-signed with the Android debug keystore → directly installable, no Play
+          # account or upload key needed. (A signed release AAB for the Play Store is a later, separate step.)
+          ./gradlew assembleDebug --stacktrace
+          echo "APK(s):"; find app/build/outputs -name "*.apk"
+    artifacts:
+      - mobile/android/app/build/outputs/**/*.apk
+    # Download the APK from the build page. To get it emailed like TestFlight, add a `publishing.email` block
+    # here (or notifications in the Codemagic UI). A signed release AAB → Google Play internal testing is a
+    # separate workflow we can add once the shell is verified on a device.