Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

README.md

@@ -0,0 +1,56 @@
+# KeepOrg
+
+A synchronization adapter for KeePass. Your databases stay ordinary `.kdbx`
+files that KeePassXC, KeePass2 or KeePassDX opens directly; a server keeps
+them in step between everyone who has access.
+
+The server never opens a database and cannot read one. Master passwords stay
+on the clients.
+
+- **Server** (`keeporgd`, Linux): hosts many KDBX databases, controls access
+  with a tree of user groups, accepts registrations by invite link or OIDC,
+  and pushes updates to connected clients.
+- **Desktop client** (`keeporg`, Linux, macOS, Windows, BSD): mirrors every
+  assigned database into one directory as a real file, pushes each save and
+  applies what others push.
+- **Android client**: the same, published to every file picker as a storage
+  provider.
+
+No third-party dependencies, no cgo, no FUSE.
+
+## Quick start
+
+```sh
+make check                 # gofmt, vet, tests
+make all                   # keeporgd and keeporg for this host
+
+# a server for trying it out, on 127.0.0.1:8765
+KEEPORG_ADMIN_PASSWORD=dev-password-1 make run-server
+
+# in another shell
+build/linux-arm64/keeporg login -server http://127.0.0.1:8765 -user admin
+build/linux-arm64/keeporg groups
+build/linux-arm64/keeporg db -create "Team Vault" -group <group-id>
+build/linux-arm64/keeporg run
+```
+
+Then save a new KDBX database as `Team Vault.kdbx` in `~/KeepOrg` from your
+KeePass application. It becomes version 1 on the server, and every later save
+is pushed automatically.
+
+## Packaging
+
+```sh
+make deb        # Debian packages for the client and the server
+make dmg        # macOS disk image with an /Applications symlink (on macOS)
+make windows    # Windows zip with a Task Scheduler job
+make android    # unsigned release APK (needs the Android SDK)
+make help       # every target
+```
+
+## Documentation
+
+- [docs/HANDOVER.md](docs/HANDOVER.md) — architecture, the decisions behind
+  it, operations, and what is left to do.
+- [docs/PROTOCOL.md](docs/PROTOCOL.md) — the HTTP API.
+- [android/README.md](android/README.md) — the Android module.