fix(android): usesCleartextTraffic=true — release APK blocked HTTP APIs (Android 9+ default)

release 构建默认禁明文 HTTP（debug 由 Flutter 自动放行）——服务暂时不可用
即此因。当前测试服务器 API/观众页均为 http://，需显式允许；上 https 后移除。

Co-Authored-By: Claude Code <noreply@anthropic.com>

apps/viewer/e2e/embed-v2.spec.ts

@@ -313,20 +313,26 @@ test.describe.serial('E04 interactions: pause, click lock, keyboard, destroy', (
     await openHost(page, { width: 1440, height: 900 });
     const frame = page.locator('iframe[src*="/embed/"][src*="v=2"]');
     await frame.waitFor();
-    const inside = page.frameLocator('iframe[src*="/embed/"][src*="v=2"]');
-    // 先悬停冻结（避免点击瞬间目标位移——点击锁定的正是防错图语义）。
+
+    // 悬停冻结 + 坐标直击当前命中的照片（.first() 可能已滚出视口——flaky 源）。
     const box = await frame.boundingBox();
-    await page.mouse.move((box!.x ?? 0) + 90, (box!.y ?? 0) + 140);
+    const cx = (box!.x ?? 0) + 90;
+    const cy = (box!.y ?? 0) + 140;
+    await page.mouse.move(cx, cy);
     await page.waitForTimeout(400);
-    const target = inside.locator('a.stream-photo').first();
-    const photoId = await target.getAttribute('data-photo-id');
-    expect(photoId).toBeTruthy();
+    const embedFrame0 = page.frames().find((f) => f.url().includes('v=2'));
+    expect(embedFrame0).toBeDefined();
+    const photoId = await embedFrame0!.evaluate(([_x, _y]) => {
+      const el = document.elementFromPoint(_x, _y)?.closest('a.stream-photo');
+      return el?.getAttribute('data-photo-id') ?? '';
+    }, [90, 140] as const);
+    expect(photoId).not.toBe('');
     // 宿主内弹框（用户决策 2026-09-23）：不新开标签，宿主页覆盖层 + 详情 iframe。
     let popupOpened = false;
     page.once('popup', () => {
       popupOpened = true;
     });
-    await target.click();
+    await page.mouse.click(cx, cy);
     const modalFrame = page.locator('iframe[title="PhotoLive photo detail"]');
     await modalFrame.waitFor({ timeout: 5000 });
     expect(popupOpened).toBe(false);
@@ -432,8 +438,12 @@ test.describe.serial('E05 realtime hearts: real burst drives particles', () => {
     await page.waitForTimeout(500);
     const embedFrame = page.frames().find((f) => f.url().includes('v=2'));
     expect(embedFrame).toBeDefined();
-    const photoId = await embedFrame!.locator('a.stream-photo').first().getAttribute('data-photo-id');
-    expect(photoId).toBeTruthy();
+    // 坐标命中当前可见照片（.first() 可能已滚出视口——事件心只对可见照片出泡）。
+    const photoId = await embedFrame!.evaluate(() => {
+      const el = document.elementFromPoint(90, 140)?.closest('a.stream-photo');
+      return el?.getAttribute('data-photo-id') ?? '';
+    });
+    expect(photoId).not.toBe('');
     // 真实公开路径点赞（ov 域）：服务端广播 likes.burst → 订阅出泡。
     const like = await page.request.post(
       `http://127.0.0.1:8081/v1/public/albums/${albumToken}/photos/${photoId}/likes`,