security: harden login WebView — block file/content access and geolocation

The WebView holds the claude.ai session cookie; lock down every path a loaded
page could use to reach local files. No effect on the login/SSO flow.

app/src/main/java/me/khodak/claudeusage/LoginActivity.kt

@@ -75,6 +75,15 @@ class LoginActivity : AppCompatActivity() {
                 databaseEnabled = false
                 javaScriptCanOpenWindowsAutomatically = false
                 setSupportMultipleWindows(false)
+                // Hardening: this WebView holds the claude.ai session, so lock down every path a
+                // page could use to reach the device. None of these affect the login flow.
+                allowFileAccess = false
+                allowContentAccess = false
+                @Suppress("DEPRECATION")
+                allowFileAccessFromFileURLs = false
+                @Suppress("DEPRECATION")
+                allowUniversalAccessFromFileURLs = false
+                setGeolocationEnabled(false)
                 // Standard Android Chrome UA — less suspicious than desktop
                 userAgentString = "Mozilla/5.0 (Linux; Android 13; Pixel 7) " +
                     "AppleWebKit/537.36 (KHTML, like Gecko) " +