fix(mobile): bump Flutter to 3.47.9 for Android TLS fix (#9309)

Flutter 3.47.7's bundled Dart TLS verifier on Android misses Android's
compromised-intermediate blocklist and, on Android 14+, reads the older
CA directory
([GHSA-frr6-h895-5pxp](https://github.com/dart-lang/sdk/security/advisories/GHSA-frr6-h895-5pxp)).
An on-path attacker can therefore impersonate the relay to Android
builds with a certificate chained to the compromised eMudhra
intermediates. Flutter 3.47.8+ ships the patched verifier. This bumps
the hermit pin to the latest patch, 3.47.9 (Dart 3.13.7), and raises the
SDK floor in `pubspec.yaml` and CONTRIBUTING to match.

Tracked in BSEC-29. iOS and macOS use Apple's certificate verification
and aren't affected by this advisory.

Patch-level bump within 3.47: no source, formatter or dependency changes
were needed; `pubspec.lock` only changes the Flutter floor. No visible
change, so no screenshots.

### Validation

- `flutter analyze`: no issues. `dart format`: no changes.
- Full mobile suite on 3.47.9: 4,596 passed, 67 skipped.
- Not done: an Android device run that repeats the eMudhra interception
test against a 3.47.9 build.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Signed-off-by: Tom Brow <tomb@squareup.com>
Co-authored-by: Tom Brow <tomb@squareup.com>

CONTRIBUTING.md

@@ -83,7 +83,7 @@ We review as capacity allows — focused PRs that follow this guide move fastest
 | Rust | 1.88+ | Install via [rustup](https://rustup.rs/) |
 | Node.js | 24+ | Required for desktop app commands and `just ci` |
 | pnpm | 10+ | Required for desktop app commands and `just ci` |
-| Flutter | 3.47.7+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) |
+| Flutter | 3.47.9+ | Required for mobile app — install via [flutter.dev](https://docs.flutter.dev/get-started/install) |
 | Xcode | 27.1 recommended; 26 supported | Required for iOS builds; see [iOS toolchain setup](mobile/README.md#ios-toolchain) |
 | Docker | 24+ | For Postgres, Redis, MinIO |
 | `just` | latest | Task runner — `cargo install just` |

bin/dart

@@ -1 +1 @@
-.flutter-3.47.7.pkg
+.flutter-3.47.9.pkg

bin/flutter

@@ -1 +1 @@
-.flutter-3.47.7.pkg
+.flutter-3.47.9.pkg

mobile/pubspec.lock

@@ -1814,4 +1814,4 @@ packages:
     version: "2.2.4"
 sdks:
   dart: ">=3.11.4 <4.0.0"
-  flutter: ">=3.47.7"
+  flutter: ">=3.47.9"

mobile/pubspec.yaml

@@ -5,7 +5,7 @@ version: 0.0.0+1
 
 environment:
   sdk: ^3.11.4
-  flutter: ">=3.47.7"
+  flutter: ">=3.47.9"
 
 dependencies:
   flutter: