Improve proxy guidance and upload assertions

[JSvandijk]

Summary

• Adds a concrete proxy deployment checklist for trusted-network use and unsafe public exposure cases.
• Extracts the proxy upload-button injection script into a shared module and adds DOM-level assertions for placement, hidden file input creation, paste dispatch, and fallback placement.
• Adds Android WebView upload source-marker checks for the critical injection path.
• Updates docs/evidence/starter issue text so the repo no longer claims missing upload assertion coverage.
• Bumps ESLint from 10.2.1 to 10.3.0.

Verification

• npm test passed
• npm outdated returned no outdated packages
• git diff --check passed
• cmd /c build-apk.bat passed and produced a dev-signed APK

Notes

The invalid HTTPS emulator verification issue remains open because the currently attached emulator is unauthorized, so the latest runtime could not be recaptured honestly in this pass.