Fix gRPC auth metadata keys, allow TLS 1.2 for Android clients

- Read x-engpad-username/x-engpad-password from gRPC metadata
  (matching what the Android client sends)
- Allow TLS 1.2 on gRPC port — Android's BoringSSL/OkHttp transport
  does not negotiate TLS 1.3 without Conscrypt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/grpcserver/interceptors.go

@@ -29,8 +29,8 @@ func AuthInterceptor(database *sql.DB) grpc.UnaryServerInterceptor {
 			return nil, status.Error(codes.Unauthenticated, "missing metadata")
 		}
 
-		usernames := md.Get("username")
-		passwords := md.Get("password")
+		usernames := md.Get("x-engpad-username")
+		passwords := md.Get("x-engpad-password")
 		if len(usernames) == 0 || len(passwords) == 0 {
 			return nil, status.Error(codes.Unauthenticated, "missing credentials")
 		}