android: vendor OpenSSL so the Rust core links (task 1864)

First Android build failed at openssl-sys: "Could not find directory of OpenSSL
installation". reqwest is pinned to native-tls, which is right for Windows — it
resolves to schannel there and keeps C and assembly out of the cross-compile —
but on Android it resolves to OpenSSL, and there is no Android OpenSSL in the
image to link against.

Vendored rather than rustls. rustls builds faster and was the obvious fix, but it
ships its own root store, so the phone would trust a different set of
certificates than the desktop: a self-hosted server behind a private or
enterprise CA would work on one surface and fail on another. Peer surfaces that
quietly disagree about who to trust is a worse outcome than a slower build, so
one TLS stack stays everywhere and OpenSSL gets compiled from source with the NDK
toolchain — which is what perl and make are in ci-tauri-android for.

Scoped to cfg(target_os = "android") so nothing changes for the Linux, Windows or
web lanes; declared as a direct dependency purely to flip the feature, since
cargo's unification then applies it to the copy native-tls pulls in.

Cargo.lock regenerated in the same commit, per the documented procedure — the
--locked gates in every lane fail otherwise. openssl-src 300.6.1+3.6.3 joins.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

desktop/src-tauri/Cargo.lock

@@ -2382,6 +2382,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.1+3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -2390,6 +2399,7 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -3941,6 +3951,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "log",
+ "openssl-sys",
  "reqwest 0.12.28",
  "rusqlite",
  "serde",

desktop/src-tauri/Cargo.toml

@@ -63,6 +63,23 @@ reqwest = { version = "0.12", default-features = false, features = ["json", "nat
 # cross-compile lane nothing — see ci-requirements.md on why that matters here.
 sha2 = "0.10"
 
+# Android has no system OpenSSL to link against, and `native-tls` resolves to
+# OpenSSL there — unlike Windows, where it lands on schannel and costs nothing.
+# Without this the build dies at `openssl-sys`: "Could not find directory of
+# OpenSSL installation".
+#
+# `vendored` compiles OpenSSL from source with the NDK toolchain (hence perl + make
+# in ci-tauri-android). The alternative was rustls on Android only, which builds
+# faster — but rustls ships its own root store, so the phone would trust a
+# DIFFERENT set of certificates than the desktop does. A self-hosted server behind
+# a private or enterprise CA would then work on one surface and fail on another,
+# and "the surfaces behave the same" is worth more here than build minutes.
+#
+# Declared as a direct dependency purely to turn the feature on: cargo's feature
+# unification applies it to the copy `native-tls` pulls in transitively.
+[target.'cfg(target_os = "android")'.dependencies]
+openssl-sys = { version = "0.9", features = ["vendored"] }
+
 # Tauri's default release profile: smaller, faster shipped binaries.
 [profile.release]
 codegen-units = 1