feat(android): add photo-permission rationale and recent-photos strip

android/Gutenberg/src/main/AndroidManifest.xml

@@ -3,6 +3,25 @@
 
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
+    <!-- Used by the block inserter media strip to preview recent device photos.
+         Inherited in the merged manifest, so it shows up in the host's Play
+         Store data-safety disclosure. Hosts that don't render the inserter or
+         already declare these permissions for their own media flows can opt
+         out via the manifest merger:
+
+             <uses-permission
+                 android:name="android.permission.READ_MEDIA_IMAGES"
+                 tools:node="remove" />
+             <uses-permission
+                 android:name="android.permission.READ_EXTERNAL_STORAGE"
+                 tools:node="remove" />
+
+         See docs/integration.md (Android → Manifest Permissions) for details. -->
+    <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="32" />
+
     <application>
         <!-- Exposes a writeable temp-file URI to the camera app so captures can
              come back to us without the host app having to configure its own

android/Gutenberg/src/main/java/org/wordpress/gutenberg/GutenbergView.kt

@@ -37,6 +37,8 @@ import kotlinx.coroutines.launch
 import org.json.JSONException
 import org.json.JSONObject
 import org.wordpress.gutenberg.inserter.BlockPickerDialog
+import org.wordpress.gutenberg.inserter.clearPhotoPreferences
+import org.wordpress.gutenberg.inserter.warmupPhotoPrefs
 import org.wordpress.gutenberg.model.BlockInserterPayload
 import org.wordpress.gutenberg.model.EditorConfiguration
 import org.wordpress.gutenberg.model.EditorDependencies
@@ -219,6 +221,12 @@ class GutenbergView : FrameLayout {
         this.configuration = configuration
         this.coroutineScope = coroutineScope
 
+        // Warm the block-inserter's photo-prefs cache off the main thread now,
+        // well before the user can navigate to the inserter. By the time they
+        // tap `+`, the prefs read in `MediaStrip` is synchronous from the
+        // process-wide cache — no async-load placeholder, no visible flash.
+        warmupPhotoPrefs(context)
+
         // Initialize the asset loader now that context is available
         assetLoader = WebViewAssetLoader.Builder()
             .addPathHandler("/assets/", AssetsPathHandler(context))
@@ -1090,6 +1098,20 @@ class GutenbergView : FrameLayout {
     }
 
     companion object {
+        /**
+         * Clears the block inserter's photo-library preferences (rationale
+         * rejection + first-prompt tracking). Call from a host-app settings
+         * screen if you want users to re-see the rationale after dismissing it.
+         *
+         * The OS-level photo permission itself is not affected — only the
+         * in-app flags. The library's media permissions are declared in the
+         * library's manifest and inherited via manifest merging; see
+         * docs/integration.md (Android → Manifest Permissions) for the opt-out.
+         */
+        fun resetBlockPickerPhotoPreferences(context: Context) {
+            clearPhotoPreferences(context)
+        }
+
         /** Hosts that are safe to serve assets over HTTP (local development only). */
         private val LOCAL_HOSTS = setOf("localhost", "127.0.0.1", "10.0.2.2")