fix(net): 放行明文 HTTP，修复自部署地址报「网络不可用」

Android 9+ 默认禁止 cleartext，OkHttp 抛 UnknownServiceException 被映射为无网。新增 network_security_config.xml（放行 cleartext + 信任用户 CA），并给该异常单独的提示文案。

app/src/main/AndroidManifest.xml

@@ -6,6 +6,7 @@
         android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.Cyrene">

app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt

@@ -114,6 +114,7 @@ class AuthManager(private val store: SessionStore) {
         is SSLException -> CyreneError.Local(CyreneError.LocalKind.Tls)
         is SocketTimeoutException -> CyreneError.Local(CyreneError.LocalKind.Timeout)
         is ConnectException -> CyreneError.Local(CyreneError.LocalKind.ConnectFailed)
+        is java.net.UnknownServiceException -> CyreneError.Local(CyreneError.LocalKind.CleartextBlocked)
         is IOException -> CyreneError.Local(CyreneError.LocalKind.NoNetwork)
         else -> CyreneError.Local(CyreneError.LocalKind.Unknown)
     }

app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt

@@ -33,6 +33,7 @@ sealed interface CyreneError {
                 LocalKind.Tls -> "证书校验失败（自签证书暂不支持）"
                 LocalKind.Timeout -> "连接超时，服务器没有响应"
                 LocalKind.ConnectFailed -> "无法连接到服务器"
+                LocalKind.CleartextBlocked -> "系统禁止明文 HTTP 访问"
                 LocalKind.Parse -> "服务器返回的数据无法识别"
                 LocalKind.Unknown -> "发生未知错误"
             }
@@ -45,6 +46,7 @@ sealed interface CyreneError {
         Tls,
         Timeout,
         ConnectFailed,
+        CleartextBlocked,
         Parse,
         Unknown,
     }

app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  自部署场景：用户会把 App 指向自己局域网/本机的 HTTP 服务（如 http://192.168.x.x:8080、
+  http://127.0.0.1:10942），所以必须放行明文流量；同时信任用户安装的 CA，
+  便于自签证书的 HTTPS 部署。生产公网部署仍建议用 HTTPS。
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>