fix(js_widget): disable Android WebView debugging in release builds

[cursor]

Vulnerability summary

Medium (CWE-489): Android WebView remote debugging enabled unconditionally in production

JsWidget called AndroidWebViewController.enableDebugging(true) for every Android WebView instance, including release builds.

Affected location

• modules/js_widget/lib/src/mobile/js_widget.dart

Security impact

When WebView debugging is enabled, anyone with USB/ADB access (or a machine that can use chrome://inspect against a connected device) can attach to embedded JsWidget WebViews, inspect DOM content, execute JavaScript in the WebView context, and intercept or modify in-WebView behavior. This exposes sensitive data rendered in JS widgets (charts, third-party embeds, etc.) outside the intended app trust boundary.

Attack path

1. Attacker: Physical attacker with debugging access, compromised workstation with ADB pairing, or insider with device access.
2. Controlled input: None required beyond using an app that renders JsWidget on Android.
3. Reachability: JsWidgetState.instantiateController() always enabled debugging before this change.
4. Impact: Information disclosure and manipulation of WebView-isolated UI that may display user or business data.

Fix approach

• Gate AndroidWebViewController.enableDebugging behind kDebugMode via androidWebViewDebuggingEnabled().
• Add webview_debug_policy.dart and unit tests asserting debugging is disabled for non-debug builds.

Tests

• modules/js_widget/test/webview_debug_policy_test.dart