docs: Add manual QA testing checklist

Comprehensive test cases for:
- Core functionality (fullscreen, webview, whitelist)
- Admin access and settings
- Idle timeout behavior
- Boot persistence
- Edge cases and security tests

Created by Margaret 🌸
Co-authored-by: Margaret <margaret@hobbs.farm>

TESTING.md

@@ -0,0 +1,102 @@
+# TESTING.md — Manual QA Checklist
+
+## Pre-Test Setup
+
+- [ ] Fresh Android device or emulator (API 21+)
+- [ ] App installed via `adb install`
+- [ ] Device owner set: `adb shell dpm set-device-owner farm.hobbs.kioskbrowser/.KioskDeviceAdminReceiver`
+- [ ] Default config: homepage=https://hobbs.farm, PIN=1234
+
+## Core Functionality Tests
+
+### Fullscreen/Immersive Mode
+
+- [ ] Status bar hidden on launch
+- [ ] Navigation bar hidden on launch
+- [ ] Swipe from edge shows bars briefly, then auto-hide
+- [ ] Screen stays awake (no auto-sleep)
+
+### WebView Browser
+
+- [ ] Homepage loads on start
+- [ ] Pages render correctly
+- [ ] JavaScript works
+- [ ] Links within whitelist navigate properly
+- [ ] Scroll works on long pages
+
+### URL Whitelist
+
+- [ ] Whitelisted domain loads: `hobbs.farm` ✓
+- [ ] Subdomain loads: `git.hobbs.farm` ✓
+- [ ] Blocked domain redirects: `google.com` → homepage
+- [ ] Bypass attempt blocked: `hobbs.farm.evil.com` → homepage
+- [ ] Empty whitelist: all external URLs blocked
+
+### Admin Access
+
+- [ ] 3-tap top-left corner opens PIN dialog
+- [ ] Wrong PIN rejected, stays in kiosk
+- [ ] Correct PIN (1234) opens settings
+- [ ] Can change homepage URL
+- [ ] Can edit whitelist
+- [ ] Can change idle timeout
+- [ ] Can change PIN
+- [ ] Settings persist after app restart
+
+### Idle Timeout
+
+- [ ] Timer resets on touch
+- [ ] Timer resets on page navigation
+- [ ] Timeout triggers → returns to homepage
+- [ ] Session/cookies cleared on timeout
+
+### Boot & Persistence
+
+- [ ] App auto-launches on device boot
+- [ ] Lock Task Mode active (home button disabled)
+- [ ] Recent apps button disabled
+- [ ] Back button blocked or controlled
+
+## Edge Cases & Error Handling
+
+### Network Errors
+
+- [ ] No internet → graceful error message (not crash)
+- [ ] Slow connection → page loads eventually or times out gracefully
+- [ ] WiFi disconnect mid-browse → error shown, retry option
+
+### Invalid Configuration
+
+- [ ] Empty homepage URL → fallback or error
+- [ ] Malformed whitelist entry → ignored, doesn't crash
+- [ ] Invalid PIN (non-numeric) → handled gracefully
+
+### Security Tests
+
+- [ ] Cannot exit app without PIN
+- [ ] Cannot access Android settings
+- [ ] Cannot pull down notification shade
+- [ ] Cannot switch apps
+- [ ] Long-press doesn't open context menus
+
+### Stress Tests
+
+- [ ] Rapid navigation (spam links) → no crash
+- [ ] Multiple idle timeout cycles → stable
+- [ ] Leave running 1+ hours → no memory leaks
+
+## Test Results Template
+
+| Test | Pass/Fail | Notes |
+|------|-----------|-------|
+| Fullscreen mode | | |
+| Whitelist blocking | | |
+| Admin PIN access | | |
+| Boot auto-launch | | |
+| Idle timeout | | |
+| Network error handling | | |
+
+---
+
+*QA checklist by Margaret 🌸*
+*Project coordinated by Pluto 🪐*