Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

android/app/build.gradle.kts

@@ -0,0 +1,43 @@
+plugins {
+    id("com.android.application")
+    id("org.jetbrains.kotlin.android")
+}
+
+// Version comes from versions.mk through the Makefile:
+//   ./gradlew assembleRelease -PversionName=0.1.0 -PversionCode=1
+val appVersionName = (project.findProperty("versionName") as String?) ?: "0.0.0"
+val appVersionCode = ((project.findProperty("versionCode") as String?) ?: "1").toInt()
+
+android {
+    namespace = "cc.tiredsysadmin.android.keeporg"
+    compileSdk = 35
+
+    defaultConfig {
+        applicationId = "cc.tiredsysadmin.android.keeporg"
+        minSdk = 26
+        targetSdk = 35
+        versionCode = appVersionCode
+        versionName = appVersionName
+    }
+
+    buildTypes {
+        release {
+            isMinifyEnabled = false
+            // Unsigned on purpose: the private F-Droid repository signs it.
+            signingConfig = null
+        }
+    }
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_17
+        targetCompatibility = JavaVersion.VERSION_17
+    }
+    kotlinOptions {
+        jvmTarget = "17"
+    }
+    dependenciesInfo {
+        // Keep the APK free of the Google dependency metadata blob so the
+        // build is reproducible for F-Droid.
+        includeInApk = false
+        includeInBundle = false
+    }
+}