feat(island): add OTP notification handler filtering

[isaacsa51]

Description

Given any code that matches the regex for a OTP code or Single Code sign in, show island with copy and dismiss info with the code on the island.

That way if the user have the android heads up turn off via app, the Island gracefully show it to the user with different option to show from.

If the user enables this feature, in case that the app still don't have the Shizuku permission, once enable the user will be prompted to grant permission since android censors this types of notification since Android 14 afaik, granting access with ADB, shizuku or root obvs will enable island to show this info.

Type of change

• Bug fix
• New feature
• UI / visual update
• Performance improvement
• Refactoring / cleanup
• Translations
• Build / CI tooling

UI changes

Showing island and code with default options and line peek mode:

Screen_recording_20261014_222457.mp4

while OTP testing can be difficult, this was tested using a real device using adb commands to mimick different cases of codes, arranging from 3 to 8 char codes, google OTPS like G-12345 and also depending on the email, long text still sometimes will match the logic, this depends on the notification data and it's preview to see if it's contain this.

Checklist

Before submitting, please make sure:

• The base branch is set to develop (not main).
• The app builds cleanly locally with ./gradlew assembleDebug.
• Unit tests pass with ./gradlew testDebugUnitTest.
• You tested the changes on a device or emulator (including Shizuku or Root if applicable).
• New preferences use SettingsRepository for keys and getter/setter methods.
• New user-facing settings are registered in FeatureRegistry.kt for search indexing.
• New UI follows the design system in ui/core/ (RoundedCardContainer, IconToggleItem, etc.).
• Strings are added to res/values/strings.xml and drawables use rounded variants (R.drawable.rounded_*).

[sameerasw]

Hi @isaacsa51 can you resolve the conflicts with new changes?

[isaacsa51]

ready now @sameerasw

[sameerasw]

Should fix

1. The OTP permission is granted silently. PermissionGrantUtil now calls grantSensitiveNotifications() from the existing grant flow whenever the op is missing. That runs appops set … RECEIVE_SENSITIVE_NOTIFICATIONS allow, then disallows and re-allows the notification listener.
   • The OTP toggle defaults to on, so every Shizuku or root user gets this grant without asking. The description says users are prompted when they enable the feature.
   • The listener rebind also briefly drops notification access. I'd keep the grant to the explicit "grant" row in the OTP settings.
2. Domain-bound codes can match plain words. DOMAIN_BOUND returns before any keyword check and accepts #[A-Za-z0-9]{4,10}. Text like alex@acme.com #engineering would produce engineering as the code. Require at least one digit in the capture.
3. Amounts without a currency marker can look like codes. CURRENCY_BEFORE only catches symbols or a currency word before the number. A bank text such as "Do not share your OTP. Txn of 4500 INR on card…" would return 4500. This is a gap I found by reading the regexes. Checking the text after the number for a currency word, and adding a test, would cover it.
4. Wrong settings style. The new rows have descriptions: island_otp_enabled_desc, tap_to_copy_desc, bypass_filter_desc and grant_desc. Settings items here get titles only, so please drop them.
5. The checklist says the settings are in FeatureRegistry.kt, but they aren't. That file isn't in the diff, so the OTP settings won't show up in search.
6. Comments. There are many explanatory comments, against the repo rule:
   • NotificationsPlugin
   • OtpClipboard
   • OtpExtractor
   • the formatOtp comment in OtpExpanded
   • the onLineTap comment in IslandModels
   • PermissionGrantUtil
   • otpSourceText in NotificationListener

Minor

• NotificationsPlugin.popUp() has two whitespace-only lines.
• The new import in NotificationListener sits above the existing ones, out of order.
• The OTP settings block builds its own SettingsRepository and keeps local state instead of going through the ViewModel. That's the pattern you flagged on #1369. The rows nested in AnimatedVisibility may also lose the 24/4 corner grouping, so check it visually.
• The grant button uses a raw Thread { }.start().
• Extraction runs on every notification from every app, and words like "code", "pin" and "token" are common. Restricting it to message, email and sms categories would cut false positives.
• If a new alert arrives during the 1.5 s "copied" state, popUp() can override the confirmation.
• Bypass-filter defaults to on, so OTPs from apps the user excluded still appear. That seems intended, but it's worth stating in the description.
• There are no tests for the plugin flow (copy, finish, queue), only for the extractor.