app: stop the autorun upload pointing at a listener that is gone

"upload failed: HTTP 400 client sent an HTTP request to an HTTPS server"
is a TLS listener rejecting cleartext, and the cleartext was ours:
REPORT_UPLOAD_URL was http://89.185.109.150:443/report, which used to be
the adb-beacon receiver holding 0.0.0.0:443 in plaintext. Disabling that
receiver and giving 443 to echolot-server left this posting plain HTTP at
a TLS port.

Blanked rather than repointed. The endpoint existed so an unattended run
could be collected without adb, and autorun reports are now read straight
off the device with `run-as cat` — so it was buying nothing and emitting
an alarming error for a debugging convenience. Deliberately not aimed at
/v1/runs either: that is the consent-gated upload, and a debugging
shortcut must not be able to satisfy it by accident.

The message says what happened instead of implying something broke.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

echolot-app/app/build.gradle.kts

@@ -34,8 +34,16 @@ android {
         versionName = appVersionName
         // Automation: `adb shell am start -n app.echo_lot.app/.MainActivity --ez autorun true`
         // runs a measurement immediately and POSTs the report here (dev collection endpoint).
-        buildConfigField("String", "REPORT_UPLOAD_URL", "\"http://89.185.109.150:443/report\"")
+        // Empty: the collection endpoint this pointed at was the adb-beacon receiver, which held
-        buildConfigField("String", "REPORT_UPLOAD_SECRET", "\"D4OmG5gGJsElqVVbtYIZbR\"")
+        // 0.0.0.0:443 in cleartext. That service is gone and echolot-server owns 443 with TLS, so
+        // posting plaintext there now fails as "client sent an HTTP request to an HTTPS server" —
+        // an alarming error for a debugging convenience that is no longer needed, since autorun
+        // reports are read straight off the device with `run-as cat`.
+        //
+        // Deliberately not repointed at /v1/runs. That is the consent-gated upload, and a
+        // debugging shortcut must not be able to satisfy it by accident.
+        buildConfigField("String", "REPORT_UPLOAD_URL", "\"\"")
+        buildConfigField("String", "REPORT_UPLOAD_SECRET", "\"\"")
         // The bare SemVer, without the debug build's "-dev" suffix stripped away by the server's
         // parser anyway — sent to servers so they can apply their compatibility window.
         buildConfigField("String", "APP_SEMVER", "\"$appVersionName\"")

echolot-app/app/src/main/kotlin/app/echo_lot/app/RunViewModel.kt

@@ -165,7 +165,13 @@ class RunViewModel(app: Application) : AndroidViewModel(app) {
             if (devUpload) {
                 state = state.copy(currentStep = "uploading report")
                 val r = withContext(Dispatchers.IO) { ReportUploader.upload(doc) }
-                status = if (r.ok) "uploaded ✓ ${r.detail}" else "upload failed: ${r.detail}"
+                status = when {
+                    r.ok -> "uploaded ✓ ${r.detail}"
+                    // Not a failure worth alarming about: the dev collection endpoint is simply
+                    // not configured, and the run is on the device either way.
+                    r.detail.startsWith("no upload URL") -> "run complete — read it with adb"
+                    else -> "upload failed: ${r.detail}"
+                }
             }
             if (archived != null && settings.autoUpload) {
                 state = state.copy(currentStep = "uploading to server")