Tighten approve-endpoint to active shares with TTL sessions, reject non-file
FDs, lower default ticket/approval/size caps, show endpoint IDs and Public-mode
warnings, harden Android receive path checks, and run cargo-audit in CI.
Close high-severity findings from the security review: default-deny blob
gets for unmapped hashes, map collection members for ACL, fail closed on
unknown access modes, require vnd1 tickets only, redact tickets from events,
exclude Android app-data backups, and tighten secret-file creation.
Attribute provider transfer progress to each remote endpoint so the
receivers panel and catalog can show per-peer send bars for multi-file
collections while a share is active.
Add folder pickers on Android, iOS, and desktop. Desktop and iOS walk
directory paths in Rust; Android expands SAF trees to per-file FDs
with relative collection paths because directory FDs are unsupported.
Allow selecting multiple files on Android, desktop, and iOS and share them
as one transfer through the core multi-source path. Update the composer UI
for multi-file review, hide unfinished iOS receive methods, and surface
refusal reasons on the receivers list.
Make the transfer loop feel live: parse real core progress payloads, show
progress on send/receive surfaces, allow cancel/stop, retry failed receives,
and fix delivery-phase events so receiver completion updates the UI.
