[gateway] explicit registration, unregister feature

[capcom6]

Summary

Adds explicit cloud register / unregister controls in cloud server settings and reworks the SSE/FCM lifecycle coordination so realtime delivery stays correct across registration, account replacement, and unregister.

Key changes:

• Cloud settings now expose explicit Register (sign-up / sign-in / sign-in by code) and Unregister actions.
• GatewayService.registerDevice persists the new identity, then emits DeviceRegisteredEvent.Success; SSE credentials are resolved fresh on every SSEManager.connect (no cached stale token).
• SSE manager gains synchronous teardown, duplicate-connection prevention, and reconnect suppression via an isDisconnecting flag checked in every callback.
• RegistrationWorker is narrowed to updating an existing device with the FCM token (background refresh only).
• CloudServerSettingsFragment stops the gateway pipeline before registering, restores it after, and swallows non-fatal post-success UI errors.
• Fix: lifecycle cancellation no longer rolls back an already-persisted registration (outer catch now rethrows CancellationException).
• Unregister clears the local registration and stops the pipeline. It does not detach the device server-side — see "Known limitations".
• PushService.onMessageReceived and the receiver-side MessagesExportRequestedEvent collector drop cloud commands when registrationInfo == null, so an unregistered device stops acting on commands.
• Registration in HomeFragment is now single-flight across sign-up / sign-in / sign-in-by-code, and lifecycle cancellation is rethrown instead of being reported as a failure against a detached fragment.

Why

Previously registration was implicit/automatic; users could not intentionally (re)register or unregister, and several lifecycle races could leave SSE bound to a stale account or drop the registration event for SSE-only devices.

Known limitations (deferred)

GatewayService.start() revives the workers and the events receiver but does not start SSE. DeviceRegisteredEvent.Success is emitted while the receiver is stopped, so it has no collector at that moment. SSE therefore resumes only indirectly, when the FCM RegistrationWorker re-runs updateDevice() and re-emits the event to the already-restarted receiver.

This is left as-is for now. The interim workaround is the restart-app hint in device_registered_successfully; the gap is recorded in a comment on the CancellationException branch of registerDeviceInternal and is being tracked separately. Explicitly starting SSEForegroundService on both the success and rollback paths would close it.

Unregister is local-only. The device cannot be detached from its account with the current server contract, verified against the server source:

• PATCH /mobile/v1/device cannot clear the push token. MobileUpdateRequest.PushToken is a plain string, and lo.EmptyableToPtr(req.PushToken) maps both an absent and an empty value to nil; the repository then omits push_token from the update and answers 204 No Content. Sending "" is a silent no-op that is indistinguishable from success, so it was deliberately not used here.
• There is no DELETE /mobile/v1/device. Adding one is not an option: devices is the parent of messages, webhooks and inbox via ON DELETE CASCADE, and SoftDeletableModel.DeletedAt is a plain *time.Time rather than gorm.DeletedAt, so removal is a hard delete that would take the device's message history with it.

Consequence: the server keeps the push token and can still deliver commands for the previous registration once the user registers again, because registrationInfo becomes non-null. The entry-point guards close the unregistered window only. Closing this needs a server contract change — an explicit clearPushToken flag on the mobile PATCH request would do it without changing behavior for existing clients — and is tracked as a follow-up.

Test plan

• ./gradlew test - green on all variants, matching the CI step in .github/workflows/build-apk.yml.
• SSEManagerTest - not written yet. CI does run unit tests, so the concurrency rework in SSEManager would be guarded by them; the coverage gap is ours to close and is deferred to a follow-up, not blocked by tooling.
• Manual: register (SSE-only and FCM) -> verify stream starts; replace account -> verify old stream closed; destroy fragment mid-registration -> verify credentials are NOT reverted.
• Manual: unregister -> verify SSE stops and no cloud events are acted on; tap Start twice quickly on first start -> verify only one signup request is sent.
• Known gap, expected to reproduce: unregister, then register again -> commands addressed to the previous registration may still be delivered.

Confidence Score: 2/5

The PR is not yet safe to merge because SSE teardown can reopen a connection and obsolete authenticated sources can still forward commands after account replacement.

Summary

The PR adds explicit cloud registration and local unregister controls, refreshes FCM registration behavior, and reworks SSE teardown and credential resolution.

• Adds register, sign-in, and unregister actions to cloud settings.
• Persists replacement identities before emitting registration success and resolves SSE credentials on each connection.
• Rejects push and export commands while locally unregistered.
• Adds single-flight registration handling on the home screen.

_{Reviews (43) · Last reviewed commit: "[gateway] explicit registration, unregis..." · Reviewed by Greptile}

[github-actions]

🤖 Pull request artifacts

file	commit
app-release.apk	13f9dcf
app-release.aab	13f9dcf
app-insecure.apk	13f9dcf
app-insecure.aab	13f9dcf

[github-actions]

This PR is stale because it has been open for 7 days with no activity.

[github-actions]

This PR is stale because it has been open for 7 days with no activity.