feat(android): publish wrapper 1.3 with proxy sign-in

Verified live against the test server with an Nginx Proxy Manager access
list: the wrapper prompts, stores the credentials, and reconnects without
asking again. The proxy log shows 24 websocket upgrades (HTTP 101) from
the WebView user agent, so the credentials reach socket.io and the XHRs
too - which was the open question, since onReceivedHttpAuthRequest fires
for the main frame only.

Also documents what that log made obvious: requests refused in the
background raise no prompt, so switching authentication on under a
running app leaves it stuck until restarted.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0187QpThw1Y8n7aYDjHtMHax

docs/android-app.md

@@ -32,9 +32,9 @@ along the way. The steps below cover those warnings.
 | **File** | [`android/mc-webui-wrapper.apk`](../android/mc-webui-wrapper.apk) |
 | **Direct link** | https://github.com/MarekWo/mc-webui/raw/main/android/mc-webui-wrapper.apk |
 | **Size** | 4.6 MB |
-| **App version** | 1.2 |
+| **App version** | 1.3 |
 | **Package** | `it.wojtaszek.mc.wrapper` |
-| **SHA-256** | `2622e6d85c65f4d43125b720862211989718456744d45193234b5d27ee28db0c` |
+| **SHA-256** | `6309880b9453b0577485a84c3aeef2bcc620940c01c5d75006631cfa7ee22e04` |
 
 Download it directly on the phone, or copy it over from a computer.
 
@@ -141,6 +141,13 @@ This only ever appears when the server actually asks for a password. On an
 instance without one — local `http://` or a proxy with no access control — you
 will never see this screen, and nothing about the app changes.
 
+> **Turning the password on, or changing it, while the app is open.** The prompt
+> comes up when the app loads a page, not when a request it makes in the
+> background is refused. So if you switch authentication on — or change the
+> password — with the app already running, it keeps trying the old credentials
+> and the interface stops updating rather than asking you anything. Close the
+> app and open it again, and it will ask properly.
+
 ---
 
 ## What works, and what doesn't

docs/whatsnew.md

@@ -10,6 +10,10 @@ For deep technical notes, see [architecture.md](architecture.md). For the full g
 
 ## Unreleased
 
+### Features
+
+- **The Android app can now sign in to a server that asks for a password.** Putting mc-webui behind a reverse proxy is what makes publishing it to the internet reasonable, and the usual next step is to make that proxy demand a username and password — an **Access List** in Nginx Proxy Manager, for instance. The app had no answer for that: it showed the proxy's bare "401 Authorization Required" page and stopped there, which meant the phone was the one thing you could not protect. It now asks for the login the first time it connects and remembers it per server address, so later launches go straight in; get it wrong and the same prompt returns with the username already filled in. This appears **only** when your server actually asks for a password — an instance without one, local `http://` or a proxy with no access control, behaves exactly as it always has and never shows this screen. One thing worth knowing: if you turn the password on, or change it, while the app is already open, the app cannot notice mid-session — close it and open it again. This is **app version 1.3** — install the new `.apk` over the one you have; it is signed with the same key, so it goes in as an update and keeps your server address. See [android-app.md](android-app.md).
+
 ---
 
 ## 2.5.0 — 2026-08-03