Is it possible to use CloudKit Web Service
from Android native app? How will that authentication popup window appear in a native app if I want to let user able to modify records?
Can I put a button to the native app, that will open up browser and the redirected content will appear there, and when authentication successfull, specify a callback where token which uniquely identifies users, I guess user record name can be received?
Apple engineer talks about login from web here on this session video: https://developer.apple.com/videos/wwdc/2015/?id=704
CloudKit Web Services is intended "to provide a web interface for users". If you use it to provide a native Android interface, you will probably get your iOS app rejected and lose your CloudKit access entirely.
But if you want to try it, Apple already has documentation for CloudKit Web Services which explains how to authenticate users.