Pro: QA backend override, a proof-acquisition floor, and a unit-test class-init fix

[mpretty-cyro]

Three independent changes, all Pro-adjacent.

QA backend override

Lets a QA Pro backend be targeted without rebuilding, via QaLaunchConfig — matching iOS's
customProBackendUrl / customProBackendPubkey launch variables, so the Appium suite can
point both platforms at the same backend with one switch.

Both values are required together: a QA URL paired with the production signing key reads
every QA-signed proof as invalid and silently strips Pro content.

Proof-acquisition floor

ProProofGenerationWorker had no floor, and the path is a closed loop: a successful
generate force-refreshes get_pro_status, the fetch asks libsession for a renewal target,
and target = proofExpiry - PRO_RENEWAL_LEAD is permanently in the past whenever a proof
lives for less than the 60-minute lead — so it reschedules immediately, forever. Measured at
~9-11 requests/second against a backend issuing 5-minute proofs.

The floor mirrors iOS (SessionProManager.reconcileProofRenewal) and Desktop
(state/ducks/proBackendData.ts) exactly — 60s while covered, 15s × attempt capped at
900s while dark, darkAttempt reset on cover. The constants carry a comment naming them a
cross-client contract so nobody tunes one in isolation.

Two properties worth preserving in any refactor:

• It re-arms rather than skips, so throttled work still happens, just later.
  target <= now is the normal "renewal due" signal and dropping it would break real
  renewals.
• The interval is state-dependent, so an entitlement that never arrives — an abandoned
  purchase, or a server-side grant the backend hasn't ingested — settles at 15-minute
  spacing rather than hammering.

Placed at the top of doWork() rather than in the scheduler, which covers every path
that can schedule acquisition (both FetchProStatusWorker sites and
ProStatusManager.onPurchaseInFlight) rather than one branch, and matches where iOS puts
it. State lives in the existing pro_state name/value table, persisted rather than
in-memory because WorkManager can run the worker across process death and an in-memory
counter would reset and defeat the pacing. No migration.

Note: only reachable locally because the QA backend runs on a compressed clock
(provider_testing_env, ~300s proofs). Production's ~30-day proofs sit well outside the
60-minute lead. Worth fixing regardless — it is a real unbounded loop, and the compressed
clock is exactly what CI will run on.

Unit-test class-init fix

Reading a SessionProtocol constant runs System.loadLibrary("session_util"), so doing it
from ProStatusManager's companion initialiser made the class impossible to initialise
wherever the native library is absent — every JVM unit test. Mockito could not instrument
it, and the nine tests constructing a ConversationViewModel failed with
NoClassDefFoundError.

The constants stay single-sourced from libsession; they are just read on first use rather
than on class load.

Testing

assemblePlayDebug and assemblePlayAutomaticQa green. 198/198 unit tests pass (was
189/198 before the class-init fix).

[Bilb]

LGTM