[FEAT] Native YubiKey HMAC challenge-response (drop dep on abandoned ykDroid)

I currently use keepass2android and KeepassXC (linux & mac) with a yubikey challenge-response as a hardware factor. I'm worried about the long-term viability of this setup, which I think is an ideal way to have hardware-factor security on all three platforms without relying on internet access or a private company.

Problem:
HMAC-SHA1 challenge-response with a YubiKey currently requires the external ykDroid app. ykDroid was last updated in 2023 and is unmaintained afaik. With Google's upcoming verified-developer rules, which requires developer government-ID verification, an abandoned app like ykDroid is supposed to become (nearly) uninstallable in a couple months. That would break challenge-response unlock for everyone relying on it.

Possible solution:
Replace the ykdroid dependency with direct use of the official yubikit-android library. YubiOtpSession.calculateHmacSha1(slot, challenge, state) does exactly what ykDroid returns today. The desktop KeepassXC app uses the driver provided by yubico.
I understand this is not trivial because yubikit-android is Java, so it would require some sort of binding like you have for Dropbox.

I don't know any of the languages involved, but I volunteer to test stuff (with a google pixel 10 and yubikey 5C NFC), and I'll donate more Oktoberfest beers. Thank you for your work on this essential app.

Start by inspecting the existing ykDroid integration and the Dropbox binding mentioned in the issue, then read the official yubikit-android API around YubiOtpSession.calculateHmacSha1. Done means the app uses the native library instead of ykDroid for HMAC-SHA1 challenge-response and the existing Android unlock flow still works.