Refactor: simplify session bootstrap, repositories, app state and swipe rows

[dadachi]

Phase 5 (refactoring) for NativeAppTemplate-Free-Android. No intended behavior change apart from the sign-in bootstrap / email-change sign-out now surviving their screen closing (aligned with NativeAppTemplate-Android #112).

Changes (one commit each)

1. Remove the no-op Data.updateRelationships – it returned a copy with the same relationships (or the same instance), so getDatumWithRelationships() was datum and Shop/ItemTag.getData() was datum. Callers read datum; nothing merges included, as before. DataRelationshipsTest: the cases that called the removed functions are gone (they tested the no-op itself); the behavior they guarded (included resources are not merged, getData() is the decoded data, getShopName() does not come from included) stays covered.
2. Drop the unused reveal state of the swipe rows – Shop Detail and the item tag list wrote Data.isOptionsRevealed into a toMutableList() copy built during composition; nothing observed it and the next composition rebuilt it, so isRevealed was always false. SwipeableItemWithActions loses isRevealed/onExpanded/onCollapsed; Data loses isOptionsRevealed; the screens read the list from UI state. New SwipeableItemWithActionsTest (swipe left opens and stays open across a parent recomposition; swipe right closes) passed against the old API before the change and after it.
3. Trim NativeAppTemplateAppState – unused isLoggedIn/shouldUpdateApp/shouldUpdatePrivacy/shouldUpdateTerms removed; shouldShowBottomBar = authDestination == SHOPS (same condition, same initial false); one stateIn helper. Existing NativeAppTemplateAppStateTest unchanged.
4. Share the repositories' API request boilerplate – apiRequest/apiAction (network/ApiResponseExtensions.kt) and currentAccountId(), same helpers as paid #112. RepositoryRequestsTest (every endpoint) unchanged.
5. Run the sign-in bootstrap and email-change sign-out in the app scope – SessionLifecycle (@singleton on @ApplicationScope: start, refreshPermissions, signOut; callers await). Storing the session routes away from sign-in and cancelled the screen's scope while the permissions/locale requests were in flight; the email-change sign-out could likewise be cut short. The "fetch permissions, sign out only on 401" logic of the sign-in VM and MainActivityViewModel lives there once. Adds runCatchingCancellable (as in paid).
6. Share the item tag toggle and the account deletion error path – completeItemTag/idleItemTag go through toggle(); deleteShopkeeper uses catchShowingError (identical state update).

New tests and red checks

• SignInEmailAndPasswordViewModelTest.login_whenTheScreenClosesMidBootstrap_stillStoresThePermissionsAndSyncsTheLocale – red on the pre-change code (shopLimitCount expected 99, was -1), green after.
• ShopkeeperEditViewModelTest.updateShopkeeper_withANewEmail_whenTheScreenClosesDuringTheSignOutRequest_stillSignsOut – red on the pre-change code, green after (uses the new TestLoginRepository.onLogoutRequest hook).
• SwipeableItemWithActionsTest – each case red when its drag-end branch was broken (open → animate to 0; close → animate to open).

Existing tests otherwise only changed how view models are constructed (new sessionLifecycle parameter).

Local checks

• ./scripts/pre-push (Spotless, lint, R8 shrink, all unit tests): passed; 395 app unit tests, 0 failures.
• ./gradlew :app:assembleRelease: passed.
• No ProGuard rule or @Parcelize annotation changed.

Device check (Pixel, Free debug build, local API)

Shop list (counts), Shop1 detail: swipe reveals Complete, completing/idling works and rows close after reload; Manage Item Tags: swipe reveals Delete and swipe back closes it; item tag detail: Mark as completed / Mark as idled (toggle); Edit Item Tag: rename and rename back ("Item tag updated successfully."); Settings and Edit Profile load. Sign-out → sign-in as shopkeeper1 with this build: sign-out routed to onboarding (DELETE /shopkeeper_auth/sign_out 200), sign-in landed on the shop list with the tabs shown, and the server log shows POST /shopkeeper_auth/sign_in 200 followed by GET /{account}/api/v1/shopkeeper/permissions 200 and GET .../shops 200 (the bootstrap's permissions request now runs in the app scope). The app was left signed in as shopkeeper1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K5hZEFqXhBsUQwSWsgR6eH