chore: modernize dependencies and android tooling

[simeng-li]

Summary

Users reported that the SDK's dependencies break app builds on modern Android toolchains: starting with Android Gradle Plugin (AGP) 9.0, plugins that apply the Kotlin Gradle Plugin (KGP) no longer compile (see flutter/flutter#181383), and flutter_secure_storage 9.x is one of them. This PR modernizes the dependency stack and release is versioned as 4.0.0.

What changed

• pubspec.yaml: bump flutter_secure_storage ^9.0.0 → ^11.0.0 (KGP-free, AGP 9 ready) and flutter_web_auth_2 ^4.1.0 → ^5.1.0; require Dart ^3.8.0 / Flutter >=3.32.0; version 4.0.0.
• lib/src/modules/logto_storage_strategy.dart: drop AndroidOptions(encryptedSharedPreferences: true) — the parameter was removed in flutter_secure_storage 11. Tokens stored by older SDK versions are migrated automatically on first access (migrateOnAlgorithmChange defaults to true).
• lib/logto_client.dart: replace the deprecated ephemeralIntentFlags with preferEphemeral: true at both authenticate call sites; in flutter_web_auth_2 5.x it covers Android as well as iOS/macOS.
• lib/src/modules/id_token.dart: remove an invalid @override on a constructor that the current analyzer flags.
• jose: refresh lockfile pin 0.3.4 → 0.3.5+2, which resolves GHSA-vm9r-h74p-hg97.
• Example app: migrate example/android to the current stable Flutter template — AGP 9.1.0, Gradle 9.3.1, Java 17, no kotlin-android in the app plugins block, compileSdk 37 and minSdk 24 (required by flutter_secure_storage 11), android:taskAffinity="" on exported activities (advised by flutter_web_auth_2 5.x), jetifier removed.
• CI: new build-android job that builds the example APK, so Android build breakage fails CI instead of landing silently.
• Docs: CHANGELOG.md 4.0.0 entry with migration notes; README minimum-requirements table; fix build badge pointing at logto-io/kotlin.

Expected result

• Apps on current Flutter stable build cleanly with an AGP 9 project configuration (verified via the example app on AGP 9.1.0 / Gradle 9.3.1 / Flutter 3.47.0).
• Existing users' stored tokens survive the upgrade via flutter_secure_storage's built-in cipher migration.
• New platform floors: Dart 3.8 / Flutter 3.32, Android minSdk 24 / compileSdk 37, iOS 17.4.

Reviewer notes

• flutter_web_auth_2 5.x still applies KGP itself; builds succeed via Flutter's temporary KGP compatibility and emit a warning. Full KGP-free status requires flutter_web_auth_2 6.x, which is still in alpha — deferred until it stabilizes.
• Token migration on a device holding pre-4.0 tokens is worth a manual smoke test before release.

Testing

Tested locally

Checklist

• .changeset
• unit tests
• integration tests
• necessary TSDoc comments

[charIeszhao]

[P3] The PR description is now materially out of sync with the current head: it still says flutter_secure_storage ^11.0.0, Dart ^3.8.0 / Flutter >=3.32.0, compileSdk 37, and that a direct v9-to-v11 storage upgrade migrates automatically. The code now deliberately uses flutter_secure_storage ^10.3.1 as the migration bridge and declares Dart ^3.9.0 / Flutter >=3.35.0 / compileSdk 36. Could we refresh the summary and expected-result sections so the merge record does not preserve the behavior this PR explicitly corrected?