Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

android/README.md

@@ -0,0 +1,34 @@
+# KeepOrg for Android
+
+A KDBX synchronization adapter with no third-party dependencies: the server
+is reached with `java.net.HttpURLConnection`, JSON is parsed with the
+platform's `org.json`, and the two screens are built in code.
+
+## How a KeePass application sees it
+
+`KeepOrgProvider` is a `DocumentsProvider`, so the mirrored databases appear
+in every file picker under "KeepOrg". KeePassDX and Keepass2Android open them
+like any other document. When the application closes a file it had opened for
+writing, the provider triggers a synchronization pass, which is how a save
+reaches the server.
+
+`SyncService` is a foreground service that holds the server's event stream
+open, so a change pushed by a colleague arrives without opening the app. The
+user turns it on from the main screen; it is not started at boot.
+
+The merge policy in `Mirror.decide` is the same table as the desktop client's
+`internal/client/decide.go`. Keep the two in step.
+
+## Building
+
+The Gradle wrapper is not committed. Generate it once with a local Gradle
+8.9 or newer, or let the Makefile call Gradle directly:
+
+```
+gradle wrapper --gradle-version 8.9      # once, optional
+make android                             # unsigned release APK
+make android-publish                     # upload to the private F-Droid repo
+```
+
+The release build is deliberately unsigned: the private F-Droid repository
+signs what it publishes.