Support streamed APK uploads up to 1 GiB

[VeldtJumper]

Summary

• enable Cloud Run end-to-end HTTP/2 and Ktor h2c with bounded 4 GiB/2 CPU/2 concurrency/5 instance resources
• accept a raw streamed APK protocol through exactly 1 GiB while retaining bounded legacy multipart compatibility
• stage uploads to a temp file, parse with ZIP inflation limits, reserve/reconcile quota, and stream to Backblaze B2
• stream Android and browser uploads without whole-file byte arrays and add cancellation/cleanup
• pin drebin451-release v1.0.2 raw HTTP/2 uploader
• run JS/Wasm browser tests in CI

Verification

• ./gradlew test :app:shared:jsBrowserTest :app:shared:wasmJsBrowserTest :server:shadowJar :app:androidApp:assembleDebug :app:webApp:composeCompatibilityBrowserDistribution
• local curl --http2-prior-knowledge returned HTTP/2 200 from the built Ktor server
• independent Codex pre-commit reviews; all reported blockers addressed
• git diff --check