M1+M2: gateway core loop + agent transparency

M1 (gateway core loop / text round-trip):
- WS server (ws_server.py): bind, hello auth (constant-time), hello.ack, heartbeat, connection registry
- pairing.py: token generation, pairing store, QR payload
- adapter.py: send() -> message frame; inbound message.send -> MessageEvent -> handle_message
- app: Connect screen, GatewayClient (connect + reconnect), ChatScreen send/render, SecureStore (Android/Desktop)
- tests/ws_probe.py: probe harness driving a real turn

M2 (streaming + reasoning + tools + commentary):
- protocol.py: M2 frame types (message.start/update/stop, tool.start/progress/end, commentary)
- adapter.py: per-chat turn-state machine; classify outbound into frames; _split_reasoning; tool-line parsing
- reasoning in streaming: capture via on_stream_delta hook (kind=reasoning, gated by plugins.stream_reasoning_deltas) with a FIFO barrier, attach to message.stop
- app: live streaming bubble, ReasoningBlock (collapse + copy), ToolCard (Everything/Truncated/Nothing), dimmed commentary, typing
- docs/14-milestones.md: M1/M2 marked done; reasoning note corrected

app/shared/src/androidMain/kotlin/iris/platform/AndroidSecureStore.kt

@@ -0,0 +1,50 @@
+package iris.platform
+
+import android.content.Context
+import android.os.Build
+import iris.data.SecureStore
+import java.util.UUID
+
+/**
+ * Android pairing storage. M1: SharedPreferences (dev). M5 moves the token
+ * to EncryptedSharedPreferences per docs/10 §10.2.
+ */
+class AndroidSecureStore(context: Context) : SecureStore {
+    private val prefs = context.applicationContext.getSharedPreferences("iris", Context.MODE_PRIVATE)
+
+    override var serverUrl: String
+        get() = prefs.getString(KEY_URL, "").orEmpty()
+        set(value) = prefs.edit().putString(KEY_URL, value.trim()).apply()
+
+    override var token: String
+        get() = prefs.getString(KEY_TOKEN, "").orEmpty()
+        set(value) = prefs.edit().putString(KEY_TOKEN, value.trim()).apply()
+
+    override val deviceId: String
+        get() {
+            var id = prefs.getString(KEY_DEVICE_ID, null)
+            if (id.isNullOrBlank()) {
+                id = "dev_" + UUID.randomUUID().toString().replace("-", "").take(16)
+                prefs.edit().putString(KEY_DEVICE_ID, id).apply()
+            }
+            return id
+        }
+
+    override val deviceName: String
+        get() = "${Build.MANUFACTURER} ${Build.MODEL}".trim()
+
+    override fun savePairing(url: String, token: String) {
+        serverUrl = url
+        this.token = token
+    }
+
+    override fun clear() {
+        prefs.edit().remove(KEY_URL).remove(KEY_TOKEN).apply()
+    }
+
+    private companion object {
+        const val KEY_URL = "server_url"
+        const val KEY_TOKEN = "token"
+        const val KEY_DEVICE_ID = "device_id"
+    }
+}