chore: upgrade to AGP 9.0.1 / Gradle 9.1.0 (#598)

[Zeroupper]

What

Upgrades the Android build to AGP 9.0.1 and Gradle 9.1.0 for #598.

Component	Before	After
Gradle	8.14.3	9.1.0
Android Gradle Plugin	8.11.1	9.0.1
Kotlin (KGP)	2.2.20	2.2.20 (unchanged)

Changes

• android/gradle/wrapper/gradle-wrapper.properties: Gradle 8.14.3 → 9.1.0 (AGP 9.0 requires Gradle ≥ 9.1.0).
• android/settings.gradle: com.android.application / com.android.library 8.11.1 → 9.0.1.
• android/app/build.gradle: use proguard-android-optimize.txt — AGP 9 rejects plain proguard-android.txt (it forces -dontoptimize).

Kotlin: still on KGP, not Built-in Kotlin (yet)

The app keeps applying the Kotlin Gradle Plugin (org.jetbrains.kotlin.android 2.2.20, android.builtInKotlin=false). Full Built-in Kotlin migration is blocked: ~24 third-party plugins still apply KGP themselves (health, camera_android_camerax, location, polar, device_info_plus, flutter_web_auth_2, …), which conflicts with AGP 9's built-in Kotlin. The build emits a warning listing them but succeeds. Built-in Kotlin is a later follow-up once those plugins ship AGP-9-compatible versions.

Validation

• flutter build apk --debug ✅ (AGP 9.0.1 + Gradle 9.1.0)

Depends on

• chore: migrate Movesense from mdsflutter to carp_movesense_flutter #656 (Movesense migration). mdsflutter uses jcenter() and AGP-7-era build scripts that Gradle 9 rejects, so that swap must land first. This PR is based on that branch.

Additional plugin fixes required by AGP 9

• compileSdk hook (android/build.gradle): raise any library module below compileSdk 36 to 36. Some plugins (e.g. flutter_appauth, pulled via oidc) still target android-33; AGP 9 turns the old warning into a hard CheckAarMetadata failure.
• qr_code_scanner_plus ^2.0.10+1 → ^2.2.0: older versions declare no namespace, which AGP 9 requires (the plugin classes silently fail to compile otherwise).

[Zeroupper]

⚠️ compileSdk < 36 blocker — dropped the force-override, needs real plugin upgrades

AGP 9 turns a compileSdk mismatch from a warning into a hard build failure when a library module is compiled against a lower SDK than a dependency requires. The previous fix force-raised every library module to compileSdk = 36 in a subprojects { afterEvaluate { … } } block. That's been removed (e28a21b): it silently masks stale plugins and can compile a plugin against APIs it wasn't written for. The correct fix is to upgrade the plugins that still declare compileSdk < 36.

The 15 plugins currently below compileSdk 36 (resolved in pubspec.lock)

Plugin	Installed	compileSdk	Pulled in by	Latest on pub.dev	Latest's compileSdk	Action
permission_handler_android	13.0.1	35	permission_handler ^12.0.3 (direct) + carp_* + polar	14.0.0	37 ✅	Bump permission_handler → 14.x
audio_session	0.1.25	34	just_audio ← cognition_package	0.2.4	36 ✅	Comes with just_audio bump
just_audio	0.9.46	34	cognition_package 1.7.0	0.10.6	35 ❌	Upstream still 35 — waiting on just_audio
flutter_appauth	11.0.0	35	carp_webservices, oidc_*	12.0.2	35 ❌	Upstream still 35 — waiting on flutter_appauth
open_settings_plus	0.4.2	34	direct (open_settings_plus ^0.4.0)	0.5.0	34 ❌	Upstream still 34
flutter_activity_recognition	4.0.0	34	carp_context_package 2.0.3	4.0.0	34 ❌	Needs carp_context_package release
flutter_background	1.3.1	34	carp_mobile_sensing 2.1.8	1.3.1	34 ❌	Needs CAMS release
dchs_flutter_beacon	0.6.10	35	carp_connectivity_package 2.0.0	0.6.10	35 ❌	Needs carp_connectivity_package release
flutter_sound	9.30.0	35	carp_audio_package 2.0.0	9.30.0	35 ❌	Needs carp_audio_package release
flutter_timezone	5.1.0	35	carp_mobile_sensing 2.1.8	5.1.0	35 ❌	Needs CAMS release
light	5.0.0	35	carp_mobile_sensing 2.1.8	5.0.0	35 ❌	Needs CAMS release
location	8.0.1	35	carp_context_package 2.0.3	8.0.1	35 ❌	Needs carp_context_package release
pedometer	4.2.0	35	carp_mobile_sensing 2.1.8	4.2.0	35 ❌	Needs CAMS release
jni	1.0.3	35	jni_flutter ← path_provider_android	1.0.3	35 ❌	Upstream still 35
jni_flutter	1.0.2	35	path_provider_android 2.3.1	1.0.2	35 ❌	Upstream still 35

(compileSdk read from each version's android/build.gradle; "latest" queried from the pub.dev API.)

What needs to be upgraded

We can act on now (leaf plugins with a 36+ release):

• permission_handler → ^14.0.0 (permission_handler_android 14.0.0 = compileSdk 37). This is our biggest single win — permission_handler_android is also pulled by carp_* and polar.
• just_audio (via cognition_package) once it moves the whole tree to audio_session 0.2.4 (compileSdk 36).

Blocked on CARP-owned package releases — most offenders are pinned by our own packages. To reach 36 we need new releases of:

• carp_mobile_sensing — must bump flutter_background, flutter_timezone, light, pedometer to compileSdk-36 releases (upstream not there yet).
• carp_context_package — flutter_activity_recognition, location.
• carp_connectivity_package — dchs_flutter_beacon.
• carp_audio_package — flutter_sound.
• carp_webservices / oidc_* — flutter_appauth (upstream flutter_appauth is still 35 even on master, so this is blocked upstream regardless).

Blocked on third-party upstream (no 36 release exists):

• flutter_appauth, just_audio, open_settings_plus, jni/jni_flutter — file/track issues; nothing to do until they publish compileSdk 36.

Consequence for this PR

Until enough of the above land at compileSdk 36, an AGP-9 Android build will fail on the mismatch. Options:

1. Keep this PR as a draft until the actionable bumps (permission_handler, and CARP package releases) are in — current choice.
2. Land the AGP 9 tooling upgrade but stay on a Gradle/AGP config that only warns on the mismatch until the plugin tree catches up.

Leaving as draft pending the plugin/CARP-package upgrades above.