Go-live checklist

• No API username or password in the app code, source or BuildConfig.
• EndpointManager.setServerUrl points to production (https://api.proveid.io).
• Maven repository credentials are in ~/.gradle/gradle.properties or CI secrets, not in the project.
• aaptOptions { noCompress "tflite"; noCompress "lite" } is set.
• The camera permission is requested at runtime; users are guided if they deny it.
• The NFC step is hidden on devices without NFC.
• Document images are not saved to the gallery or shared storage.
• Liveness and hologram videos are deleted from the device after sending.
• The network security configuration doesn’t allow cleartext (HTTP) traffic.
• Users get a clear path for every error (see Errors).
• The verification decision is made on your server, not in the app.
• Tested on devices from several manufacturers, in low light, with and without NFC.