Initial commit: Deepwave Phase 1 - auth scaffolding

Spotify-like Navidrome client scaffold with Hilt DI, a Subsonic API
client (token auth, base-URL rewriting), encrypted single-server
credential storage (DataStore + Tink/Keystore), and a login/session
flow gating Compose Navigation between Login and a placeholder Home
screen.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Deepwave connects to a single, user-supplied self-hosted Navidrome server that may
+  not have TLS configured (e.g. a bare IP on a home LAN), so cleartext HTTP has to be
+  allowed for arbitrary hosts - there's no fixed domain to scope this to.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true" />
+</network-security-config>