build: consume secp256k1-frost-kmp and lightning-kmp-app as composite-build submodules

Add both libraries as git submodules and resolve them through Gradle
composite builds instead of remote publications, so local changes to
either library are picked up by the app build directly.

Submodules:
* secp256k1-frost-kmp (github.com/ac-cord-ac/secp256k1-frost-kmp) at
  2478403 -- BIP-327 FROTH/FROST signing over secp256k1, KMP.
* lightning-kmp-app (github.com/kngako/lightning-kmp-app) at 6745d88 --
  phoenix business logic on top of lightning-kmp-core. Both submodules
  carry a local commit aligning them with this build's AGP 9.1.1 /
  Kotlin 2.4.10 (AGP version must match across a composite build or the
  android variants fail attribute matching).

settings.gradle.kts:
* includeBuild() both submodule checkouts.
* lightning-kmp-app's project stays named ':library' (compose-resources
  derives its Res package from the project name), so an explicit
  dependencySubstitution maps the coordinate the app declares,
  fr.acinq.phoenix:lightning-kmp-app, onto that project.
* Drop the jitpack.io repository: it only served com.github.kngako,
  which is no longer consumed as a binary.

composeApp/build.gradle.kts:
* commonMain gains ac.cord.auxiliary:library:1.0.0 (secp256k1-frost-kmp,
  substituted by the composite build).
* commonMain replaces com.github.kngako.lightning-kmp-app:library (via
  JitPack) with fr.acinq.phoenix:lightning-kmp-app:1.0.0 (substituted by
  the composite build). lightning-kmp-core still comes from Maven
  Central.
* Remove the RestoreJitPackClassifier component-metadata rule and the
  javax.inject import: it only existed to repair the artifact
  classifiers JitPack drops from the apple metadata variants, which no
  longer applies.

gradle/libs.versions.toml:
* Remove the now-unused lightningKmpApp version and the
  com.github.kngako lightning-kmp-app catalog entry.

Verified:
  ./gradlew :composeApp:compileCommonMainKotlinMetadata             :composeApp:compileDebugKotlinAndroid

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "secp256k1-frost-kmp"]
+	path = secp256k1-frost-kmp
+	url = https://github.com/ac-cord-ac/secp256k1-frost-kmp.git
+[submodule "lightning-kmp-app"]
+	path = lightning-kmp-app
+	url = https://github.com/kngako/lightning-kmp-app.git

composeApp/build.gradle.kts

@@ -1,6 +1,5 @@
 import org.jetbrains.compose.desktop.application.dsl.TargetFormat
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
-import javax.inject.Inject
 
 plugins {
     alias(libs.plugins.androidApplication)
@@ -89,8 +88,10 @@ kotlin {
 
 
 
-            implementation(libs.lightning.kmp.app)
-            implementation(libs.lightning.kmp.core)
+//            implementation(libs.lightning.kmp.core)
+
+            // resolved via the lightning-kmp-app composite build (see settings.gradle.kts)
+            implementation("fr.acinq.phoenix:lightning-kmp-app:1.0.0")
 
             implementation(libs.navigation.compose)
 
@@ -105,6 +106,9 @@ kotlin {
 
             implementation("com.ionspin.kotlin:bignum:0.3.10")
 
+            // resolved via the secp256k1-frost-kmp composite build (see settings.gradle.kts)
+            implementation("ac.cord.auxiliary:library:1.0.0")
+
             implementation("no.synth:kmp-zip:0.8.0")
             implementation("no.synth:kmp-zip-okio:0.8.0")
         }
@@ -156,37 +160,7 @@ android {
     }
 }
 
-// JitPack rewrites the version inside a published .module file, and in doing so drops the classifier
-// from every artifact name -- so lightning-kmp-app's apple targets advertise their host-specific
-// metadata as `library-<target>-<ver>.jar` when it is actually served as `...-<ver>-metadata.jar`.
-// The klib and the aar are unaffected (android compiles either way); this only bites the metadata
-// compilations, which is what every shared ios source set resolves through. Restore the classifier.
-abstract class RestoreJitPackClassifier @Inject constructor(
-    private val variant: String,
-) : ComponentMetadataRule {
-    override fun execute(context: ComponentMetadataContext) {
-        val id = context.details.id
-        context.details.withVariant(variant) {
-            withFiles {
-                removeAllFiles()
-                addFile("${id.name}-${id.version}-metadata.jar")
-            }
-        }
-    }
-}
-
 dependencies {
-    components {
-        mapOf(
-            "library-iosarm64" to "iosArm64MetadataElements-published",
-            "library-iossimulatorarm64" to "iosSimulatorArm64MetadataElements-published",
-        ).forEach { (module, variant) ->
-            withModule<RestoreJitPackClassifier>("com.github.kngako.lightning-kmp-app:$module") {
-                params(variant)
-            }
-        }
-    }
-
     debugImplementation(libs.compose.uiTooling)
 //    ksp(libs.androidx.room3.compiler)
     add("kspAndroid", libs.androidx.room3.compiler)

gradle/libs.versions.toml

@@ -21,10 +21,6 @@ kotlinx-datetime = "0.8.0"
 kotlinxSerialization = "1.11.0"
 ksp = "2.3.6"
 ktor = "3.5.2"
-# pinned to a commit, not master-SNAPSHOT: jitpack advertises a unique-snapshot maven-metadata for
-# -SNAPSHOT versions but serves the files under their literal -SNAPSHOT names, so gradle looks for
-# library-<target>-master-<sha>-1.klib and gets a 404. bump this when the fork moves.
-lightningKmpApp = "59cc3e3c15"
 lightningKmpCore = "1.11.5"
 material3 = "1.10.0-alpha05"
 materialIconsCore = "1.7.3"
@@ -80,7 +76,6 @@ ktor-client-core = { module = "io.ktor:ktor-client-core", version.ref = "ktor" }
 ktor-client-cio = { module = "io.ktor:ktor-client-cio", version.ref = "ktor" }
 ktor-client-websockets = { module = "io.ktor:ktor-client-websockets", version.ref = "ktor" }
 ktor-serialization-kotlinx-json = { module = "io.ktor:ktor-serialization-kotlinx-json", version.ref = "ktor" }
-lightning-kmp-app = { module = "com.github.kngako.lightning-kmp-app:library", version.ref = "lightningKmpApp" }
 lightning-kmp-core = { module = "fr.acinq.lightning:lightning-kmp-core", version.ref = "lightningKmpCore" }
 navigation-compose = { module = "org.jetbrains.androidx.navigation:navigation-compose", version.ref = "navigationCompose" }
 okhttp-coroutines = { group = "com.squareup.okhttp3", name = "okhttp-coroutines", version.ref = "okhttp" }

settings.gradle.kts

@@ -25,11 +25,6 @@ dependencyResolutionManagement {
             }
         }
         mavenCentral()
-        maven("https://jitpack.io") {
-            mavenContent {
-                includeGroupAndSubgroups("com.github.kngako")
-            }
-        }
     }
 }
 
@@ -37,4 +32,14 @@ plugins {
     id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
 }
 
-include(":composeApp")
+include(":composeApp")
+
+// Composite builds: substitute the external module coordinates with the submodules' :library projects.
+includeBuild("secp256k1-frost-kmp")
+includeBuild("lightning-kmp-app") {
+    dependencySubstitution {
+        // the submodule's project stays named :library (compose-resources derives the Res package
+        // from it); only the coordinate consumers declare is renamed.
+        substitute(module("fr.acinq.phoenix:lightning-kmp-app")).using(project(":library"))
+    }
+}