Build 53: Windows + Android support with a per-platform Nym sidecar

Ship the bundled nym-socks5-client on Windows and Android, not just Linux:
- sidecar.rs resolves the binary per platform — nym-socks5-client.exe on
  Windows; on Android the sidecar rides in the APK jniLibs as
  libnym_socks5_client.so and is launched from the native-library dir (the
  one exec-allowed path), located via NATIVE_LIBS_DIR.
- Restore a vendored, statically-linked OpenSSL. Upstream Grim got this from
  arti's static feature; dropping arti for Nym took it with it, which broke
  Android/cross builds (no system OpenSSL for the target) and left desktop
  dynamically linked to libssl. Inert on Windows/macOS (SChannel/Security.fw).
- android.sh bundles the sidecar into jniLibs per ABI; scripts/nym-android.sh
  cross-builds it. Onboarding copy: Tor -> the Nym mixnet.

Verified end to end on an x86_64 emulator: the sidecar extracts, launches,
initialises, and opens the mixnet SOCKS5 proxy on 127.0.0.1:1080.

src/gui/views/goblin/onboarding.rs

@@ -194,8 +194,8 @@ impl OnboardingContent {
 			(
 				"Send like a message",
 				"Pay a @username or npub and it arrives as an end-to-end \
-				 encrypted message over nostr and Tor — no one in between can \
-				 see the amount or who's involved.",
+				 encrypted message over nostr and the Nym mixnet — no one in \
+				 between can see the amount or who's involved.",
 			),
 			(
 				"Yours alone",

src/nym/sidecar.rs

@@ -31,7 +31,16 @@ use log::{error, info, warn};
 
 use super::{SOCKS5_HOST, SOCKS5_PORT};
 
-/// Bundled SOCKS5 client binary name.
+/// Bundled SOCKS5 client binary name. Windows release archives ship the `.exe`;
+/// `Command`/`current_exe().parent().join(..)` need the suffix to find it. On
+/// Android the sidecar is shipped inside the APK's `jniLibs` as a `lib*.so` (the
+/// only files extracted to the exec-allowed native-library dir) — same trick
+/// upstream Grim used for Tor's webtunnel binary.
+#[cfg(target_os = "windows")]
+const BIN_NAME: &str = "nym-socks5-client.exe";
+#[cfg(target_os = "android")]
+const BIN_NAME: &str = "libnym_socks5_client.so";
+#[cfg(not(any(target_os = "windows", target_os = "android")))]
 const BIN_NAME: &str = "nym-socks5-client";
 
 /// Per-app client id; namespaces the config/keys under the Nym data root.
@@ -84,6 +93,17 @@ fn binary_path() -> PathBuf {
 			return PathBuf::from(p);
 		}
 	}
+	// Android: `current_exe()` is the zygote/app_process, not us — the sidecar
+	// rides in the APK's jniLibs and is extracted to the native-library dir
+	// (the one exec-allowed location). MainActivity exports it as
+	// `NATIVE_LIBS_DIR` (see android/.../MainActivity.java).
+	#[cfg(target_os = "android")]
+	if let Ok(dir) = std::env::var("NATIVE_LIBS_DIR") {
+		let p = PathBuf::from(dir).join(BIN_NAME);
+		if p.exists() {
+			return p;
+		}
+	}
 	if let Ok(exe) = std::env::current_exe() {
 		if let Some(dir) = exe.parent() {
 			let sibling = dir.join(BIN_NAME);