feat(onboarding): add a VirusTotal security page to the tutorial

Explains that any package can be scanned against VirusTotal from the
install screen, and that it needs a free API key pasted into
Settings > Advanced. Links straight to virustotal.com/gui/my-apikey —
the same URL the "no API key" error already cites.

Gated behind showVirusTotalTip so only Mobile shows it; the scanner
lives in the app module and TV has no Settings screen to paste a key
into. OnboardingPage gains actionIcon so each action button can carry
its own glyph instead of the hardcoded Tune icon.

Strings in en, zh and vi. Verified on device.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: nqmgaming

app/src/main/java/app/pwhs/universalinstaller/MainActivity.kt

@@ -112,6 +112,7 @@ class MainActivity : ComponentActivity() {
                     AppRoute.Onboarding -> OnboardingScreen(
                         onFinish = { currentRoute = AppRoute.Main },
                         showXiaomiTip = DeviceCompat.isXiaomi,
+                        showVirusTotalTip = true,
                     )
                     AppRoute.Main -> {
                         LaunchedEffect(Unit) {

core/src/main/java/app/pwhs/core/presentation/onboarding/OnboardingScreen.kt

@@ -22,7 +22,9 @@ import androidx.compose.foundation.pager.rememberPagerState
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.rounded.ArrowForward
+import androidx.compose.material.icons.automirrored.rounded.OpenInNew
 import androidx.compose.material.icons.rounded.CheckCircle
+import androidx.compose.material.icons.rounded.GppGood
 import androidx.compose.material.icons.rounded.InstallMobile
 import androidx.compose.material.icons.rounded.Security
 import androidx.compose.material.icons.rounded.Tune
@@ -45,6 +47,7 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextAlign
@@ -58,12 +61,16 @@ import androidx.datastore.preferences.core.edit
 import androidx.lifecycle.compose.LifecycleResumeEffect
 import kotlinx.coroutines.launch
 
+/** Where a free VirusTotal API key comes from — the same URL the scanner error message cites. */
+private const val VIRUSTOTAL_API_KEY_URL = "https://www.virustotal.com/gui/my-apikey"
+
 private data class OnboardingPage(
     val icon: ImageVector,
     val title: String,
     val description: String,
     /** Optional secondary action rendered under the description (e.g. "Open Developer options"). */
     val actionLabel: String? = null,
+    val actionIcon: ImageVector? = null,
     val onAction: (() -> Unit)? = null,
 )
 
@@ -73,14 +80,18 @@ private data class OnboardingPage(
  * @param showXiaomiTip inserts an extra page warning about MIUI/HyperOS optimization silently
  *   blocking installs (issue #104). Callers gate it on [DeviceCompat.isXiaomi]; TV leaves it off
  *   because the toggle doesn't exist on Xiaomi's TV builds.
+ * @param showVirusTotalTip inserts a page explaining the VirusTotal scan. Mobile-only — the
+ *   scanner lives in the app module and TV has no Settings screen to paste an API key into.
  */
 @Composable
 fun OnboardingScreen(
     onFinish: () -> Unit,
     showXiaomiTip: Boolean = false,
+    showVirusTotalTip: Boolean = false,
 ) {
     val context = LocalContext.current
     val activity = context as? android.app.Activity
+    val uriHandler = LocalUriHandler.current
     // Hide the shortcut when Developer options aren't reachable — the text alone still tells the
     // user what to look for.
     val developerOptions = remember(showXiaomiTip) {
@@ -102,6 +113,18 @@ fun OnboardingScreen(
                 description = stringResource(R.string.onboarding_page2_desc),
             )
         )
+        if (showVirusTotalTip) {
+            add(
+                OnboardingPage(
+                    icon = Icons.Rounded.GppGood,
+                    title = stringResource(R.string.onboarding_virustotal_title),
+                    description = stringResource(R.string.onboarding_virustotal_desc),
+                    actionLabel = stringResource(R.string.onboarding_virustotal_get_key),
+                    actionIcon = Icons.AutoMirrored.Rounded.OpenInNew,
+                    onAction = { uriHandler.openUri(VIRUSTOTAL_API_KEY_URL) },
+                )
+            )
+        }
         if (showXiaomiTip) {
             add(
                 OnboardingPage(
@@ -111,6 +134,7 @@ fun OnboardingScreen(
                     actionLabel = developerOptions?.let {
                         stringResource(R.string.onboarding_xiaomi_open_developer_options)
                     },
+                    actionIcon = Icons.Rounded.Tune,
                     onAction = developerOptions?.let { intent -> { context.startActivity(intent) } },
                 )
             )
@@ -306,12 +330,10 @@ private fun PageContent(
             val label = page.actionLabel ?: return@let
             Spacer(Modifier.height(32.dp))
             OutlinedButton(onClick = action) {
-                Icon(
-                    Icons.Rounded.Tune,
-                    contentDescription = null,
-                    modifier = Modifier.size(18.dp),
-                )
-                Spacer(Modifier.width(8.dp))
+                page.actionIcon?.let { icon ->
+                    Icon(icon, contentDescription = null, modifier = Modifier.size(18.dp))
+                    Spacer(Modifier.width(8.dp))
+                }
                 Text(label)
             }
         }

core/src/main/res/values-vi/strings.xml

@@ -9,6 +9,9 @@
     <string name="onboarding_page2_desc">Duyệt qua các ứng dụng đã cài đặt, gỡ cài đặt những ứng dụng không mong muốn và quản lý thiết bị của bạn một cách dễ dàng.</string>
     <string name="onboarding_page3_title">Cho phép cài đặt</string>
     <string name="onboarding_page3_desc">Để cài đặt các gói, ứng dụng cần có quyền cài đặt từ các nguồn không xác định. Nhấn vào nút bên dưới để cấp nó.</string>
+    <string name="onboarding_virustotal_title">Quét trước khi cài</string>
+    <string name="onboarding_virustotal_desc">Mọi gói bạn mở đều có thể kiểm tra bằng VirusTotal — hơn 70 engine diệt virus — ngay trong màn hình cài đặt. Nhấn \"Kiểm tra bằng VirusTotal\" và kết quả hiện ra trước khi bạn xác nhận. Tính năng này cần API key miễn phí: lấy ở nút bên dưới rồi dán vào Cài đặt &gt; Nâng cao &gt; VirusTotal API Key.</string>
+    <string name="onboarding_virustotal_get_key">Lấy API key miễn phí</string>
     <string name="onboarding_xiaomi_title">Nếu cài đặt thất bại trên MIUI</string>
     <string name="onboarding_xiaomi_desc">Tối ưu hóa MIUI/HyperOS có thể chặn cài đặt từ bên thứ ba mà không báo lý do. Nếu gặp trường hợp đó, hãy mở Tùy chọn nhà phát triển, tắt \"Tối ưu hóa MIUI\", cài đặt ứng dụng rồi bật lại. Khi đang tắt, giao diện hệ thống có thể bị lỗi hiển thị — khởi động lại điện thoại sẽ khắc phục.</string>
     <string name="onboarding_xiaomi_open_developer_options">Mở Tùy chọn nhà phát triển</string>

core/src/main/res/values-zh/strings.xml

@@ -9,6 +9,9 @@
     <string name="onboarding_page2_desc">浏览已安装的应用程序、卸载不需要的应用程序并轻松管理您的设备。</string>
     <string name="onboarding_page3_title">允许安装</string>
     <string name="onboarding_page3_desc">要安装软件包，应用程序需要从未知来源安装的权限。点击下面的按钮以授予它。</string>
+    <string name="onboarding_virustotal_title">安装前先扫描</string>
+    <string name="onboarding_virustotal_desc">您打开的任何安装包都可以直接在安装界面用 VirusTotal（70 多个杀毒引擎）检查。点击\"使用 VirusTotal 检查\"，结果会在您确认安装前显示。此功能需要免费的 API 密钥：在下方获取，然后粘贴到设置 &gt; 高级 &gt; VirusTotal API 密钥。</string>
+    <string name="onboarding_virustotal_get_key">获取免费 API 密钥</string>
     <string name="onboarding_xiaomi_title">如果在 MIUI 上安装失败</string>
     <string name="onboarding_xiaomi_desc">MIUI/HyperOS 优化可能会在不给出原因的情况下阻止第三方安装。若遇到这种情况，请进入开发者选项，关闭\"MIUI 优化\"，安装应用后再重新打开。关闭期间系统主题可能显示异常，重启手机即可恢复。</string>
     <string name="onboarding_xiaomi_open_developer_options">打开开发者选项</string>

core/src/main/res/values/strings.xml

@@ -11,6 +11,9 @@
     <string name="onboarding_page2_desc">Browse installed apps, uninstall unwanted ones, and manage your device effortlessly.</string>
     <string name="onboarding_page3_title">Allow Installation</string>
     <string name="onboarding_page3_desc">To install packages, the app needs permission to install from unknown sources. Tap the button below to grant it.</string>
+    <string name="onboarding_virustotal_title">Scan before you install</string>
+    <string name="onboarding_virustotal_desc">Any package you open can be checked against VirusTotal — 70+ antivirus engines — straight from the install screen. Tap \"Check with VirusTotal\" and the result appears before you commit. It needs a free API key: get one below, then paste it into Settings &gt; Advanced &gt; VirusTotal API Key.</string>
+    <string name="onboarding_virustotal_get_key">Get a free API key</string>
     <string name="onboarding_xiaomi_title">If an install fails on MIUI</string>
     <string name="onboarding_xiaomi_desc">MIUI/HyperOS optimization can block third-party installs without saying why. If that happens, open Developer options, turn off \"MIUI optimization\", install the app, then turn it back on. While it is off the system theme may look distorted — restarting the phone fixes that.</string>
     <string name="onboarding_xiaomi_open_developer_options">Open Developer options</string>