fix: integrate backend with android and rearrange signup and complete profile flows

[kckagancan]

Summary

This PR integrates the backend with Android clients for the authentication and profile flows.

It also updates the signup flow so that users no longer enter profile details such as full name and phone number during signup. These fields are now collected later in the complete profile flow, making the authentication flow simpler and keeping profile completion as a separate step.

Changes

• integrated backend API calls for Android auth/profile flow
• connected login, signup, email verification, profile fetch, and profile update flows to the backend
• moved full name and phone number collection out of signup for both web and android (1 page for web)
• updated complete profile flow to collect the missing required profile fields
• updated profile/edit profile flow to sync with backend data

Notes

• signup now focuses only on account creation
• profile completion is handled after authentication
• both web and Android now follow the same general auth/profile flow
• only one file from web/ is changed. Rest of the changes are for android/

Can you review? @erinc00 @gulcetahtasiz

Closes #132

[erinc00]

Thanks for the update. I reviewed the latest Android changes in detail.

That said, I still see a few issues that should be addressed before merge:

1. AuthRepository.login() clears the session too aggressively after successful auth
   In AuthRepository.login(), the access token is already obtained successfully, but if the subsequent profile fetch fails with a non-401 backend error, the token is cleared and the user is effectively logged out. Temporary /profiles/me failures should not necessarily invalidate a valid authenticated session. I think token clearing should be limited to actual auth-invalid cases such as 401.

2. SignupScreen writes local profile state before signup succeeds
   SignupScreen updates ProfileRepository before the signup request is confirmed successful. If the backend signup fails, local profile state can still be partially written and become inconsistent. This local save should happen only after successful signup, or be rolled back on failure.

3. usesCleartextTraffic="true" is too broad as currently configured
   I understand this may be needed for emulator/local backend development, but enabling cleartext traffic globally in the manifest is risky. This should ideally be restricted to debug-only behavior or handled through a more scoped network security setup.

4. ProfileRepository.syncProfile() is very fragmented and can leave the backend partially updated
   ProfileRepository.syncProfile() currently performs multiple sequential backend updates, so partial backend updates are possible if one of the later calls fails. The current backend contract may require this, but it is still worth noting as a consistency risk.

Additional notes / follow-up items:

5. CompleteProfileScreen collects date of birth in the UI but syncs only age to the backend
   The current profile flow collects date of birth in the UI but syncs only age to the backend. I do not think Android alone should fully solve this in this PR, so this can be treated as a backend follow-up. Still, backend support for storing a real birthDate field should be requested; otherwise, this data cannot round-trip cleanly across sessions/devices.

[kckagancan]

Thanks for the detailed review. Went through the points and updated the Android side accordingly.

• AuthRepository.login()
  Adjusted the login flow so that a successful auth session is no longer cleared for temporary/non-auth profile fetch failures. Session cleanup is now limited to auth-invalid cases such as 401. We also stopped clearing the session on coroutine cancellation.

• SignupScreen
  Re-checked this flow and did not find a pre-success local profile write in SignupScreen. The signup screen only triggers AuthRepository.signup() and proceeds on success. The local profile write happens after a successful signup response.

• usesCleartextTraffic
  Removed the global usesCleartextTraffic="true" from the main manifest and scoped it to the debug manifest only, so local HTTP development still works without leaving the setting broadly enabled.

• ProfileRepository.syncProfile()
  The concern about fragmented multi-endpoint updates is valid. Given the current backend contract, the client still has to perform multiple sequential updates, so a fully atomic fix is not possible on Android alone. As a mitigation, we improved the failure path to re-fetch and re-align local profile state with the backend when a partial failure occurs.

• Birth date vs age
  Agreed that this is primarily a backend contract follow-up. The Android UI currently collects birthDate, but the backend persists only age, so a proper round-trip birthDate field would need backend support.

Can you review again? @erinc00

[gulcetahtasiz]

Looks good now, thanks for addressing the feedback.

The issues raised in the previous review are properly resolved, especially around session handling, signup flow, and cleartext configuration. The syncProfile mitigation also makes sense given current backend constraints.

The remaining birthDate note can be handled on the backend side. approved

[erinc00]

Looks good to me overall. I reviewed the latest changes and the implementation seems consistent with the intended flow. I do not see any major blocker from my side at this point, so I’m approving. Ready to merge.