release(v4.0.0): Shade GA — V3.x consolidation + audit prep

V3.1 → V3.12 consolidated and tagged for the first GA release. Wire
format unchanged from 0.4.x — 4.0 peers interoperate with 0.4.x peers
byte-for-byte. The version bump is semantic: audit-cycle complete,
opt-in surface fully exposed, threat model refreshed for every new
surface.

Highlights:
- All 24 @shade/* packages bumped to 4.0.0 in lockstep.
- CHANGELOG 4.0.0 section is the canonical manifest of what landed.
- THREAT-MODEL extended (§10 fingerprint gates, §11 WebRTC P2P, §12
  Web-Worker boundary) + residual-risks table refreshed.
- OpenAPI now covers all 27 routes: prekey, transfer, KT, inbox,
  bridge, observer, /metrics, /healthz, /ready.
- MIGRATION 0.3.x → 4.0 documented + smoke-tested against
  shade migrate-storage on a real SQLite DB.
- docs/audit/REVIEW-BUNDLE.md + SCOPE.md ready for external reviewer.
- scripts/soak.ts harness for the GA-stable 2-week soak window.
- All V*.md plans archived under docs/archive/ with Status: Done.
- Voice/Video carved out into V5.0; 4.0 audit focuses on the frozen
  non-realtime stack.

Tests: TS 1000/1000 + Kotlin 11/11 cross-platform vectors green.
Docker: gt.zyon.no/stian/shade-prekey:4.0.0 builds and reports
  version 4.0.0 on /health.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

android/shade-android/build.gradle.kts

@@ -1,50 +1,51 @@
 plugins {
-    id("com.android.library")
-    kotlin("android")
+    kotlin("jvm")
+    `java-library`
 }
 
-android {
-    namespace = "no.zyon.shade"
-    compileSdk = 35
+// V3.5 — Cross-platform parity gate.
+//
+// This module compiles as a pure-JVM Kotlin library so CI can run the
+// cross-platform vector tests without an Android SDK. The protocol code
+// is JVM-safe (no `android.*` imports); only Tink + java.* are used.
+//
+// When KeystoreStorage and EncryptedSharedPreferences-backed adapters land
+// (M-Cross 4 + V3.5 §Storage), they will live in a sibling Android Library
+// module that depends on this one.
 
-    defaultConfig {
-        minSdk = 26
-        testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-    }
+java {
+    sourceCompatibility = JavaVersion.VERSION_17
+    targetCompatibility = JavaVersion.VERSION_17
+}
 
-    buildFeatures {
-        buildConfig = true
-    }
-
-    compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_17
-        targetCompatibility = JavaVersion.VERSION_17
-    }
-
-    kotlinOptions {
-        jvmTarget = "17"
+kotlin {
+    compilerOptions {
+        jvmTarget.set(org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17)
     }
 }
 
 dependencies {
-    // Google Tink for X25519, Ed25519, AES-GCM, HMAC, HKDF
-    implementation("com.google.crypto.tink:tink-android:1.15.0")
+    // Google Tink for X25519, Ed25519, AES-GCM, HMAC, HKDF (JVM build).
+    // The same `subtle.*` API as `tink-android` so the source compiles unchanged.
+    implementation("com.google.crypto.tink:tink:1.15.0")
 
-    // Android Keystore + EncryptedSharedPreferences
-    implementation("androidx.security:security-crypto:1.1.0-alpha06")
-
-    // JSON serialization for session state
+    // JSON serialization (session state + test-vector loader on JVM).
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.3")
 
-    // Coroutines for async interop
-    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.9.0")
+    // Coroutines (StorageProvider uses `suspend` functions).
+    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.9.0")
 
-    // SQLite for session storage (optional; can also use EncryptedSharedPreferences only)
-    implementation("androidx.sqlite:sqlite:2.4.0")
-
-    // OkHttp for transport
-    implementation("com.squareup.okhttp3:okhttp:4.12.0")
+    // org.json — bundled with Android but not present on the JVM classpath.
+    implementation("org.json:json:20240303")
 
     testImplementation("junit:junit:4.13.2")
     testImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.9.0")
 }
+
+tasks.withType<Test>().configureEach {
+    useJUnit()
+    testLogging {
+        events("passed", "failed", "skipped")
+        showStandardStreams = false
+    }
+}