fix(nsf): replace regex with isSha1Hex to eliminate ICU JNI crash

Repeated calls to Regex("^[0-9a-fA-F]{40}$").matches() in applyAuth()
allocate a new ICU MatcherNative_matchesImpl invocation on every poll
cycle (2× per 60 s = ~120/hour). On Samsung Galaxy S24 FE / Android 15
with Scudo+MTE enabled, the jintArray chunk header used by
ReleaseIntArrayElements becomes corrupted after many poll cycles (~73
minutes in observed logs), triggering a SIGABRT that kills the app.

Crash signature (Samsung SM-S721B, Android 15, AP3A.240905.015.A2):
  Scudo ERROR: corrupted chunk header
  #5 scudo::Allocator::deallocate
  #6 JNI::ReleasePrimitiveArray<jintArray>
  #7 CheckJNI::ReleasePrimitiveArrayElements
  #8 MatcherNative_matchesImpl  (libicu_jni.so)
  thread: NightscoutFollower-<serial>

Fix: replace the regex with isSha1Hex(), a pure Kotlin char scan that is
semantically equivalent but makes no ICU JNI calls. Returns true iff the
string is exactly 40 characters of [0-9a-fA-F].

Adds edge-case tests: lowercase, uppercase, mixed-case SHA1 hex, 39-char,
and 40-char non-hex (contains 'g').

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Rob

Common/src/main/java/tk/glucodata/drivers/nightscout/NightscoutFollowerRegistry.kt

@@ -146,10 +146,19 @@ object NightscoutFollowerRegistry {
         }
         connection.setRequestProperty(
             "api-secret",
-            if (trimmed.matches(Regex("^[0-9a-fA-F]{40}$"))) trimmed else sha1(trimmed)
+            if (isSha1Hex(trimmed)) trimmed else sha1(trimmed)
         )
     }
 
+    // Replaces Regex("^[0-9a-fA-F]{40}$") to avoid repeated ICU JNI allocation on
+    // the NightscoutFollower HandlerThread.  On Samsung Android 15 with Scudo+MTE the
+    // ReleaseIntArrayElements call inside MatcherNative_matchesImpl corrupts the chunk
+    // header after many poll cycles, resulting in a fatal SIGABRT.
+    private fun isSha1Hex(s: String): Boolean {
+        if (s.length != 40) return false
+        return s.all { it in '0'..'9' || it in 'a'..'f' || it in 'A'..'F' }
+    }
+
     private fun sha1(value: String): String =
         MessageDigest.getInstance("SHA-1")
             .digest(value.toByteArray(Charsets.UTF_8))

Common/src/test/java/tk/glucodata/drivers/nightscout/NightscoutFollowerRegistryTests.kt

@@ -49,14 +49,45 @@ class NightscoutFollowerRegistryTests {
     }
 
     @Test
-    fun applyAuth_rawSha1Hex_sentAsApiSecret() {
-        // 40-char hex = raw SHA1 (Nightscout stores api-secret this way)
-        val sha1hex = "a".repeat(40)
+    fun applyAuth_rawSha1Hex_lowercase_sentAsApiSecret() {
+        val sha1hex = "a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1"
         val headers = applyAuthToMock(sha1hex)
         assertEquals(sha1hex, headers["api-secret"])
         assertNull(headers["Authorization"])
     }
 
+    @Test
+    fun applyAuth_rawSha1Hex_uppercase_sentAsApiSecret() {
+        val sha1hex = "A0B1C2D3E4F5A0B1C2D3E4F5A0B1C2D3E4F5A0B1"
+        val headers = applyAuthToMock(sha1hex)
+        assertEquals(sha1hex, headers["api-secret"])
+        assertNull(headers["Authorization"])
+    }
+
+    @Test
+    fun applyAuth_rawSha1Hex_mixedCase_sentAsApiSecret() {
+        val sha1hex = "a0B1C2d3E4f5A0b1C2D3e4F5a0B1C2d3E4f5A0b1"
+        val headers = applyAuthToMock(sha1hex)
+        assertEquals(sha1hex, headers["api-secret"])
+        assertNull(headers["Authorization"])
+    }
+
+    @Test
+    fun applyAuth_39charHex_hashed() {
+        val notSha1 = "a".repeat(39)
+        val headers = applyAuthToMock(notSha1)
+        assertNotEquals(notSha1, headers["api-secret"])
+        assertNotNull(headers["api-secret"])
+    }
+
+    @Test
+    fun applyAuth_40charNonHex_hashed() {
+        val notHex = "a".repeat(39) + "g"
+        val headers = applyAuthToMock(notHex)
+        assertNotEquals(notHex, headers["api-secret"])
+        assertNotNull(headers["api-secret"])
+    }
+
     @Test
     fun applyAuth_plainText_hashed() {
         val plain = "my-super-secret"