Restrict internet permissions and network deps to free flavor only

- Add tools:node="remove" for INTERNET, CHANGE_NETWORK_STATE, and
  ACCESS_NETWORK_STATE in the offline manifest to explicitly strip any
  internet permissions injected by library AARs during manifest merge
- Move coil-okhttp (OkHttp network backend for Coil) from implementation
  to freeImplementation; remove duplicate okhttpCoroutines plain dep
- kmp-tor was already freeImplementation; this completes the isolation

app/build.gradle

@@ -243,9 +243,8 @@ dependencies {
     implementation libs.coil.gif
     // view svgs
     implementation libs.coil.svg
-    // enables network for coil
-    implementation libs.coil.okhttp
-    implementation libs.okhttpCoroutines
+    // enables network for coil (free only — offline has no network stack)
+    freeImplementation libs.coil.okhttp
 
     implementation libs.storage
 

app/src/offline/AndroidManifest.xml

@@ -2,6 +2,11 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:tools="http://schemas.android.com/tools">
 
+    <!-- Explicitly remove INTERNET permission — offline flavor has no network stack -->
+    <uses-permission android:name="android.permission.INTERNET" tools:node="remove" />
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" tools:node="remove" />
+    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" tools:node="remove" />
+
     <application
         android:name=".Amber"
         android:allowBackup="false"