Clean up lint/LSP across gateway, Android, and desktop (alpha -> stable)

Gateway (gateway-plugin/):
- Fix interactive_setup broken imports: print helpers were imported from the
  wrong hermes module (hermes_cli.config instead of hermes_cli.cli_output) plus
  a non-existent print_code; the try/except swallowed the ImportError so
  `hermes gateway setup` for android always bailed out early.
- Fix release_scoped_lock type error (str | None passed where str required).
- Rewrite empty `except: pass` blocks as contextlib.suppress with rationale.
- Restructure two ambiguous ws_server try blocks (hello-auth, frame loop).
- Ruff cleanup: type annotations, import sorting, line wrapping, magic values
  -> named constants, `raise ... from e`, complexity. Add gateway-plugin/ruff.toml.
- Add pyrightconfig.json so the Python LSP resolves hermes-runtime imports.
- Suppress verified false positives inline (parameterized SQL, column-name
  "secrets", hermes-generated media path).

Android (app/androidApp + app/shared):
- Consolidate launcher icons into a single mipmap-anydpi (minSdk 29 >= 26) with
  the monochrome layer; clears ObsoleteSdkInt + MonochromeLauncherIcon.
- Bump core-splashscreen 1.0.1 -> 1.2.0; pin targetSdk 34 (deliberate).
- Suppress verified findings inline (LAN ws:// default, correct GCM IV usage).

Desktop (app/desktopApp):
- Move the desktop to a Java 21 runtime (org.gradle.java.home) and set the
  desktop jvmTarget to 21 (Android stays JVM 17 / minSdk 29). Fixes the startup
  UnsupportedClassVersionError and restores Markdown renderer 0.44.0.

Tooling/config:
- .pi-lens.json: disable verified-noisy heuristics (documented in docs).
- .gitleaks.toml: allowlist git-ignored false-positive paths.
- docs/18-code-review.md: full findings + verification.

Verified: ruff clean, pyright 0 errors, 64/64 gateway tests, all Kotlin tests,
Android lint 0 issues, Android installed+launched on device, desktop launches
on JDK 21.

app/shared/src/commonMain/kotlin/iris/ui/screens/ConnectScreen.kt

@@ -43,6 +43,9 @@ fun ConnectScreen(
     initialError: String? = null,
 ) {
     val scope = rememberCoroutineScope()
+    // Default is a cleartext (non-TLS) URL because the typical gateway is on
+    // the LAN. A TLS gateway is reached by entering a secure (wss) URL instead.
+    // pi-lens-ignore: opengrep:javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket
     var url by remember { mutableStateOf(prefillUrl.ifBlank { "ws://" }) }
     var token by remember { mutableStateOf(prefillToken) }
     var busy by remember { mutableStateOf(false) }
@@ -76,6 +79,8 @@ fun ConnectScreen(
                 value = url,
                 onValueChange = { url = it },
                 label = { Text("Server URL") },
+                // Example LAN URL; wss:// works too for TLS gateways.
+                // pi-lens-ignore: opengrep:javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket
                 placeholder = { Text("ws://192.168.1.10:8790/ws") },
                 singleLine = true,
                 keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri),

app/shared/src/commonMain/kotlin/iris/util/TimeFormat.kt

@@ -12,7 +12,7 @@ expect fun localDayKey(epochMillis: Long): String
 /** Current wall-clock time in epoch milliseconds (for locally generated items). */
 expect fun nowMillis(): Long
 
-/** Host part of a pairing URL ("ws://host:port/ws" -> "host:port"). */
+/** Host part of a pairing URL (the "host:port" of the full gateway ws URL). */
 fun hostFromUrl(url: String): String {
     val noScheme = url.trim().substringAfter("://")
     return noScheme.substringBefore("/").ifBlank { url.trim() }