Fix Firebase image-loading crash: use OkHttp Ktor engine explicitly

[StylianosGakis]

The firebase crash as I understand originates from the fact that we were not explicitly using the latest Okhttp engine for ktor to use, so it was defaulting to a built-in one in Android which is not the latest and greatest.
This adds the engine explicitly which should make it use the latest properly.

AI description below:

What & why

Fixes the Crashlytics/Firebase crash "Exception in completion handler … Cancelling", whose true root cause (bottom of the causal chain) is:

java.lang.IllegalStateException: Unbalanced enter/exit
    at com.android.okhttp.okio.AsyncTimeout.enter
    ...
    at coil3.compose.AsyncImagePainter.onForgotten

Seen on production 14.4.2 (e.g. Pixel 7 / Android 17, Xiaomi 24115RA8EG / Android 16), both while the Chat screen was loading images.

Chain of events

1. Coil forgets an AsyncImagePainter while an image request is in flight (composable leaving composition) and cancels the Ktor load job.
2. Cancellation closes the underlying HTTP stream mid-read.
3. That stream runs on the platform Android engine (java.net.HttpURLConnection → com.android.okhttp), a frozen ~2015 okhttp fork whose AsyncTimeout throws Unbalanced enter/exit on a concurrent close.
4. The exception is raised inside a coroutine cancellation handler on the main thread during Compose applyChanges, so nothing catches it and the app dies.

How we ended up on the platform engine

The platform engine was never chosen deliberately. The Jan 2026 OkHttp→Ktor migration (b93c73e3) dropped authlib's explicit pre-configured OkHttp engine in favour of a bare HttpClient { }, which resolves an engine via ServiceLoader from whatever is on the classpath. The only engine present was ktor-client-android (pulled in by auth-core-public), so every request, including Coil image loads sharing the base client, silently ran on the platform fork. Maintained com.squareup.okhttp3 handles the concurrent cancel cleanly and never throws on this path.

The fix

Select the engine explicitly per platform instead of relying on implicit ServiceLoader resolution.

Module	Android	JVM	iOS
network-clients (base client: Coil + Apollo + all app traffic)	OkHttp	OkHttp	Darwin
authlib (auth-token client)	via jvm → OkHttp	OkHttp	Darwin

• network-clients: commonMain gains expect fun httpClientEngineFactory(), used in buildKtorClient; actuals in androidMain/jvmMain (OkHttp, the maintained okhttp3 5.4.0 already shipping for Datadog) and nativeMain (Darwin).
• authlib: same expect/actual pattern; removed the dangling HttpClientEngine import the migration left behind.
• auth-core-public: dropped its ktor-client-okhttp dependency. It builds no client and only fed authlib's implicit engine off the classpath.
• Version catalog: added ktor-client-okhttp, removed unused ktor-client-android and ktor-client-cio.

iOS behaviour is unchanged (still Darwin/NSURLSession); the crash was Android-only. A missing or wrong engine is now a compile-time error per platform rather than a silent runtime default, so this class of regression cannot recur unnoticed.

Verification

• :app:assembleDebug ✅
• :network-clients:compileKotlinIosSimulatorArm64 + :authlib:compileKotlinIosSimulatorArm64 ✅
• ktlint on both changed modules ✅