Harden download routine: storage checks, single verification, URL expiry

- Check free space before downloading (only the not-yet-fetched bytes) and, on
  Android O+, use StorageManager.getAllocatableBytes/allocateBytes so the system
  can evict its cache; fail fast with a clear message instead of dying mid-write.
  SessionInstaller sets a SessionParams size hint so staging can reserve space
  too.
- Verify each APK at most once: files already verified during the download pass
  are skipped in the final verification gate. Prefer SHA-256 and log SHA-1
  fallback.
- An expired download URL (403/410) now clears the stored file lists and retries,
  re-purchasing fresh URLs instead of repeatedly failing on the dead one.
- Cancel promptly mid-file rather than only between files, and cancel copyTo's
  progress timer in a finally to avoid leaking the timer thread.
- Download.canInstall now requires a real .apk on disk; DownloadStatus
  finished/running are Sets.

app/src/main/res/values/strings.xml

@@ -149,6 +149,7 @@
     <string name="download_eta_min">%1$dm %2$ds left</string>
     <string name="download_eta_sec">%1$ds left</string>
     <string name="download_failed">"Download failed"</string>
+    <string name="download_failed_storage">Not enough storage space to download this app</string>
     <string name="download_force_clear_all">"Force clear all"</string>
     <string name="download_metadata">"Getting metadata"</string>
     <string name="download_none">"No downloads"</string>