Clean up lint/LSP across gateway, Android, and desktop (alpha -> stable)

Gateway (gateway-plugin/):
- Fix interactive_setup broken imports: print helpers were imported from the
  wrong hermes module (hermes_cli.config instead of hermes_cli.cli_output) plus
  a non-existent print_code; the try/except swallowed the ImportError so
  `hermes gateway setup` for android always bailed out early.
- Fix release_scoped_lock type error (str | None passed where str required).
- Rewrite empty `except: pass` blocks as contextlib.suppress with rationale.
- Restructure two ambiguous ws_server try blocks (hello-auth, frame loop).
- Ruff cleanup: type annotations, import sorting, line wrapping, magic values
  -> named constants, `raise ... from e`, complexity. Add gateway-plugin/ruff.toml.
- Add pyrightconfig.json so the Python LSP resolves hermes-runtime imports.
- Suppress verified false positives inline (parameterized SQL, column-name
  "secrets", hermes-generated media path).

Android (app/androidApp + app/shared):
- Consolidate launcher icons into a single mipmap-anydpi (minSdk 29 >= 26) with
  the monochrome layer; clears ObsoleteSdkInt + MonochromeLauncherIcon.
- Bump core-splashscreen 1.0.1 -> 1.2.0; pin targetSdk 34 (deliberate).
- Suppress verified findings inline (LAN ws:// default, correct GCM IV usage).

Desktop (app/desktopApp):
- Move the desktop to a Java 21 runtime (org.gradle.java.home) and set the
  desktop jvmTarget to 21 (Android stays JVM 17 / minSdk 29). Fixes the startup
  UnsupportedClassVersionError and restores Markdown renderer 0.44.0.

Tooling/config:
- .pi-lens.json: disable verified-noisy heuristics (documented in docs).
- .gitleaks.toml: allowlist git-ignored false-positive paths.
- docs/18-code-review.md: full findings + verification.

Verified: ruff clean, pyright 0 errors, 64/64 gateway tests, all Kotlin tests,
Android lint 0 issues, Android installed+launched on device, desktop launches
on JDK 21.

gateway-plugin/pairing.py

@@ -9,6 +9,7 @@ Storage: ``get_hermes_home()/"android"/devices.db``.
 Milestone M1.
 """
 
+import contextlib
 import hmac
 import json
 import logging
@@ -98,10 +99,7 @@ class DeviceRegistry:
             # M5: migrate pre-push-cursor databases (the column carries the
             # highest outbox cursor already delivered to the device via the
             # push backend; hello.ack returns it for notification dedupe).
-            cols = {
-                r["name"]
-                for r in self._conn.execute("PRAGMA table_info(devices)").fetchall()
-            }
+            cols = {r["name"] for r in self._conn.execute("PRAGMA table_info(devices)").fetchall()}
             if "last_pushed_cursor" not in cols:
                 self._conn.execute(
                     "ALTER TABLE devices ADD COLUMN last_pushed_cursor INTEGER NOT NULL DEFAULT 0"
@@ -200,17 +198,13 @@ class DeviceRegistry:
 
     def list(self) -> list[dict[str, Any]]:
         with self._lock:
-            rows = self._conn.execute(
-                "SELECT * FROM devices ORDER BY last_seen DESC"
-            ).fetchall()
+            rows = self._conn.execute("SELECT * FROM devices ORDER BY last_seen DESC").fetchall()
         return [_row_to_device(r) for r in rows]
 
     def close(self) -> None:
-        with self._lock:
-            try:
-                self._conn.close()
-            except Exception:
-                pass
+        with self._lock, contextlib.suppress(Exception):
+            # Best-effort: a close failure on shutdown is not actionable.
+            self._conn.close()
 
 
 def _row_to_device(row: sqlite3.Row) -> dict[str, Any]: