Capacitor Native-Layer Hardening Audit + Remediation Plan

Degree of freedom: HIGH — native-layer inventory and plan. Stay plan-only. No config, manifest, or code edits until approved.

This skill vs neighbors

How to reason (every plan item)

1. Propose — config, storage, deep-link, or WebView change
2. Risk — what a extracted APK or hijacked scheme actually exposes
3. Keep-working — native controls that already hold in production
4. Phase — prod-config leaks → tokens → auth → WebView → OTA (do not execute)