ci: publish PR web previews

[gac0812]

Summary

• carry the PR Web Preview workflow and nested Expo base-path configuration on top of the corrected frontend dependency graph
• deploy static preview builds under PR-specific GitHub Pages paths and clean them up when PRs close

Dependency

• depends on refactor(frontend): add tested shared overlays and UI primitives #129, feat(frontend): add session transport and contracts #130, feat(frontend): add schedule workflows #131, feat(frontend): add voice assistant flows #132, feat(frontend): add native alarms and voice recording #136, and feat(frontend): integrate connected app flows #137

[fennoai]

I found two concrete issues in the preview workflow and Android network configuration; details are attached inline.

[fennoai]

This condition skips the entire job whenever the PR head repository is a fork, which includes this PR. As a result, fork PRs never export, deploy, or receive a preview comment. If fork previews are intended to be supported, use a trigger/checkout design that preserves token safety while allowing the preview; otherwise this workflow should document that limitation rather than presenting itself as a general PR preview.

[fennoai]

Setting android:usesCleartextTraffic to true on the application enables plaintext HTTP for every Android build, including release builds, not just the LAN ws:// use case mentioned in the comment. This weakens the release transport security and permits other app traffic to be downgraded/intercepted. Keep cleartext disabled for release builds and scope any LAN-development exception to a debug-only configuration.