fix: derive JWT iat from server clock

Shaarli rejects tokens whose iat falls outside its clock
tolerance, so device/server skew caused HTTP 401 logins
even with a correct API secret. Estimate server time from
the Date response header, retry a 401 once with a
recalibrated token, trim credentials on login, and explain
the API-secret vs password mismatch in French error
messages.

Bump version to 2.14.1 (code 42).

app/src/main/java/com/shaarit/domain/usecase/LoginUseCase.kt

@@ -6,9 +6,13 @@ import javax.inject.Inject
 
 class LoginUseCase @Inject constructor(private val repository: AuthRepository) {
     suspend operator fun invoke(url: String, secret: String): Result<Boolean> {
-        if (url.isBlank() || secret.isBlank()) {
+        // Trim so a trailing space from copy/paste or autocomplete does not silently
+        // corrupt the URL or the HMAC key (which would surface as an obscure HTTP 401).
+        val cleanUrl = url.trim()
+        val cleanSecret = secret.trim()
+        if (cleanUrl.isBlank() || cleanSecret.isBlank()) {
             return Result.failure(IllegalArgumentException("URL and Secret cannot be empty"))
         }
-        return repository.login(Credentials(url, secret), url)
+        return repository.login(Credentials(cleanUrl, cleanSecret), cleanUrl)
     }
 }