feat(core,app,android,cli,ios): sync the library and settings, verify a share before adding it

Sync carried only watch positions, so a second device started empty. The
per-installation history file now also carries per-key registers
(pstr-core::profile): every share with its link and custom password, the
playback, appearance and metadata settings, the TMDB key, hand-picked
matches and per-title track choices. Newer updated_at wins per key, a
removal travels as an empty register, and a first sync stamps at 0 so a
fresh install takes the library the other devices have instead of
overwriting it with defaults. Volume, mute and the device-only settings
(cache budget, Wi-Fi only, background audio, hardware decoding) stay out.
The secrets live only in the end-to-end encrypted Drive file, never in
shares.json. FORMAT_VERSION stays 1; an older build ignores the registers.

Adding a share stored it before opening the link, so a first failure left a
broken entry and every retry said "already configured". add_verified opens
the link first and stores nothing on failure, and only the new share is
crawled afterwards, so another broken share cannot fail the add.

Android drops picture-in-picture: the window sized the video wrongly and
background audio already covers leaving the app.

iOS sizes the Metal drawable on every layout, so the picture no longer
stretches after a rotation or a Split View resize. Settings show a save at
once rather than after the match run, and a failed save reverts and says
why. Both phone clients gain an activity banner naming what is running, and
the add-share, metadata and change-match forms show progress and errors in
place.

scripts/android-acceptance.py

@@ -604,23 +604,6 @@ for _name, _what, _method in (
 ):
     REGISTRY.append(Case(name=_name, what=_what, run=_live(_method), needs_share=True))
 
-# Still unimplemented, and the only case left that is. No longer blocked on the
-# app: B40 landed, so there is correct behaviour to assert. What is missing is a
-# driver — every live case here reads the engine and libmpv directly, and this
-# one needs the activity with the player composed on screen before PiP means
-# anything.
-REGISTRY.append(
-    Case(
-        name="picture-in-picture",
-        what="entering PiP keeps playing and shows only video",
-        run=_pending(
-            "needs an activity-level driver: the live suite exercises the engine "
-            "and libmpv, not the composition, and PiP is a property of the window"
-        ),
-        needs_share=True,
-    )
-)
-
 
 # --------------------------------------------------------------------------
 # runner