Implement Rust-owned Android local and HTTPS onboarding (#95)

crates/android/src/lib.rs

@@ -4,3 +4,6 @@
 //! The shared component owns every conversion; no interface is copied here.
 
 ironstorage_mobile::uniffi_reexport_scaffolding!();
+
+#[cfg(target_os = "android")]
+mod tls;

crates/android/src/tls.rs

@@ -0,0 +1,17 @@
+//! OS certificate-verifier initialization only; Git/TLS policy stays in storage.
+//! The JNI macro supplies a scoped valid environment and catches boundary panics;
+//! rustls retains global Context/class-loader references before this scope ends.
+use jni::{Env, objects::JObject};
+
+const _: jni::NativeMethod = jni::native_method! {
+    java_type = "de.rfc1437.ironstorage.bridge.NativeTls",
+    extern fn initialize(context: JObject),
+};
+
+fn initialize<'local>(
+    env: &mut Env<'local>,
+    _this: JObject<'local>,
+    context: JObject<'local>,
+) -> Result<(), jni::errors::Error> {
+    rustls_platform_verifier::android::init_with_env(env, context)
+}