feat(android): add photo-permission rationale and recent-photos strip

Layers on the Photos / Camera tiles introduced in #509 with a full
permission state machine, a rationale card, and a recent-photos
thumbnail strip.

- Three media-strip states resolved at runtime by `resolveMediaStripView`
  in `PhotoAccessState.kt`:
  1. **Rationale card** — shown when `READ_MEDIA_IMAGES` isn't granted
     and the user hasn't dismissed it. Body copy and primary-button
     label switch across three sub-states (`Unasked` / `Denied` /
     `PermanentlyDenied`); SharedPreferences tracks the first-prompt
     flag because `shouldShowRequestPermissionRationale` alone can't
     tell "never asked" from "permanently denied".
  2. **Compact tiles** — once the rationale is rejected, the Photos /
     Camera column flattens into a full-width 88dp row. The rejection
     auto-clears when permission is later granted, so a future
     revocation surfaces the rationale again.
  3. **Full strip** — once granted, queries MediaStore for the 64 most
     recent images and renders them as a horizontally-scrolling 2-row
     thumbnail grid. LazyRow keeps off-screen thumbnails out of memory.
- Strip is gated to Android 10+ (`ContentResolver.loadThumbnail` is
  API 29+); on Android 7-9 the inserter falls back to the permissionless
  Photos/Camera tile row and never requests the media permission.
- Process-wide thumbnail cache keyed on (uri, sizePx) — 32 entries,
  ~6MB worst case. `RealThumbnail` seeds from the cache synchronously
  so scroll-back and dialog reopen skip the grey-placeholder flash.
  Failed-to-load URIs drop from the displayed strip and re-attempt on
  the next dialog open.
- Android 14+ partial-grant treated as granted by also checking
  `READ_MEDIA_VISUAL_USER_SELECTED` when `READ_MEDIA_IMAGES` is denied.
  Without this, a "Select photos" choice fell through to the
  rationale's "Open Settings" state for a permission the user had just
  granted.
- Photo-prefs reads off the main thread via a process-wide cache
  warmed from `GutenbergView`'s constructor on `Dispatchers.IO`.
  Writes update the cache synchronously and queue
  `SharedPreferences.edit().apply()` on the IO scope.
- Soft-input mode `STATE_HIDDEN | ADJUST_RESIZE` — `STATE_HIDDEN`
  dismisses an in-flight IME on open; `ADJUST_RESIZE` lets the sheet
  shrink to make room when the user taps the in-dialog search field.
- Observes the host Activity's lifecycle (not the BottomSheetDialog's
  own) for `ON_RESUME`, so grants made via system Settings update the
  strip on return without restart.
- `GutenbergView.resetBlockPickerPhotoPreferences(context)` exposed for
  host apps that want to clear the rationale-rejection / first-prompt
  flags from a settings screen — also wired into the demo's `⋮` menu
  as **Manage Permissions**. Demo uses a Settings hand-off rather than
  `revokeSelfPermissionOnKill` (API 33+, demo's `minSdk = 24`).
- Library declares `READ_MEDIA_IMAGES` and `READ_EXTERNAL_STORAGE`
  (max SDK 32). Host apps can opt out via `tools:node="remove"`;
  documented in `docs/integration.md` (Android → Manifest Permissions),
  including the `xmlns:tools` namespace requirement, with the opt-out
  XML inlined as a comment in `AndroidManifest.xml` for auditors
  diffing the merged manifest.
- Demo's "Enable Native Inserter" toggle defaults to on so reviewers
  see the new strip without flipping a setting; the standalone-editor
  E2E test toggles it off so the existing web-inserter assertions
  still resolve.

Touch targets on the rationale buttons meet the Material 48dp minimum
via a wrapper that keeps the visual 32dp pill while inflating the click
area; a shared `MutableInteractionSource` keeps the ripple drawing
inside the pill instead of as a square halo.

Verified on Pixel 9 Pro XL with \`./gradlew :Gutenberg:detekt
:Gutenberg:assembleDebug :Gutenberg:testDebugUnitTest\` (includes
\`PhotoAccessStateTest\`).

Author: jkmassel

android/Gutenberg/src/main/AndroidManifest.xml

@@ -3,6 +3,25 @@
 
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
+    <!-- Used by the block inserter media strip to preview recent device photos.
+         Inherited in the merged manifest, so it shows up in the host's Play
+         Store data-safety disclosure. Hosts that don't render the inserter or
+         already declare these permissions for their own media flows can opt
+         out via the manifest merger:
+
+             <uses-permission
+                 android:name="android.permission.READ_MEDIA_IMAGES"
+                 tools:node="remove" />
+             <uses-permission
+                 android:name="android.permission.READ_EXTERNAL_STORAGE"
+                 tools:node="remove" />
+
+         See docs/integration.md (Android → Manifest Permissions) for details. -->
+    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="32" />
+
     <application>
         <!-- Exposes a writeable temp-file URI to the camera app so captures can
              come back to us without the host app having to configure its own

android/Gutenberg/src/main/java/org/wordpress/gutenberg/GutenbergView.kt

@@ -37,6 +37,8 @@ import kotlinx.coroutines.launch
 import org.json.JSONException
 import org.json.JSONObject
 import org.wordpress.gutenberg.inserter.BlockPickerDialog
+import org.wordpress.gutenberg.inserter.clearPhotoPreferences
+import org.wordpress.gutenberg.inserter.warmupPhotoPrefs
 import org.wordpress.gutenberg.model.BlockInserterPayload
 import org.wordpress.gutenberg.model.EditorConfiguration
 import org.wordpress.gutenberg.model.EditorDependencies
@@ -219,6 +221,12 @@ class GutenbergView : FrameLayout {
         this.configuration = configuration
         this.coroutineScope = coroutineScope
 
+        // Warm the block-inserter's photo-prefs cache off the main thread now,
+        // well before the user can navigate to the inserter. By the time they
+        // tap `+`, the prefs read in `MediaStrip` is synchronous from the
+        // process-wide cache — no async-load placeholder, no visible flash.
+        warmupPhotoPrefs(context)
+
         // Initialize the asset loader now that context is available
         assetLoader = WebViewAssetLoader.Builder()
             .addPathHandler("/assets/", AssetsPathHandler(context))
@@ -1090,6 +1098,20 @@ class GutenbergView : FrameLayout {
     }
 
     companion object {
+        /**
+         * Clears the block inserter's photo-library preferences (rationale
+         * rejection + first-prompt tracking). Call from a host-app settings
+         * screen if you want users to re-see the rationale after dismissing it.
+         *
+         * The OS-level photo permission itself is not affected — only the
+         * in-app flags. The library's media permissions are declared in the
+         * library's manifest and inherited via manifest merging; see
+         * docs/integration.md (Android → Manifest Permissions) for the opt-out.
+         */
+        fun resetBlockPickerPhotoPreferences(context: Context) {
+            clearPhotoPreferences(context)
+        }
+
         /** Hosts that are safe to serve assets over HTTP (local development only). */
         private val LOCAL_HOSTS = setOf("localhost", "127.0.0.1", "10.0.2.2")