Ghost FTP v0.95.42 — Android signing source alignment (development preview)

Published predecessor: v0.95.41. The published predecessor tag is immutable.

Scope

Integrate OAuth loopback callback state validation and token redaction from PR #190 into the same consolidated source SHA; no duplicate security PR is needed.
Retain the existing manual, protected Android upload signer integrated by PR #189. Do not introduce another signer or a debug-key fallback.
Align version.json, Android versionCode 954200, Rust/Tauri/frontend/Go/installers, Cargo.lock, updater and active docs with v0.95.42 Preview.
Preserve unsigned production Android CI artifacts and separate isolated signed preview APK.

Version/release/documentation preflight and all six key CI families on the same final PR SHA.
After merge, confirm the same six families on the merged-main SHA.
Supply an approved existing Play upload certificate, restricted GitHub environment secrets and record a real signed AAB/Play Console track acceptance.
Prove previous production build upgrade with data preserved; separately verify Play app-signing certificate.
Complete real macOS FTPS/SFTP, vendor cloud and security/performance matrices in separate PRs.

See protected signing and upgrade acceptance. No release or production readiness is claimed.