Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

android/metadata/cc.tiredsysadmin.android.keeporg.yml

@@ -0,0 +1,44 @@
+# F-Droid metadata for the private repository.
+# Publish with: make android-publish  (copies this file to the metadata
+# directory and the unsigned APK to the unsigned directory).
+Categories:
+  - Security
+License: AGPL-3.0-or-later
+AuthorName: tiredsysadmin
+SourceCode: https://garage.rcmd.space/keeporg
+IssueTracker: https://garage.rcmd.space/keeporg/issues
+
+Name: KeepOrg
+Summary: Collaborative sync adapter for KeePass databases
+Description: |-
+  KeepOrg mirrors the KDBX databases a KeepOrg server has assigned to you and
+  publishes them to every file picker on the device, so KeePassDX or
+  Keepass2Android opens them as ordinary files.
+
+  Each save is pushed to the server, and changes other people push are applied
+  here. When two people save at once, the database's merge strategy decides
+  the outcome; the losing copy is always kept beside the file so nothing is
+  lost silently.
+
+  The app never opens a database and never sees a master password. It moves
+  encrypted bytes and nothing else.
+
+  Sign in with a password and the server's built-in time-based second factor,
+  or approve the device in a browser, which is also how single sign-on works.
+
+RepoType: git
+Repo: https://garage.rcmd.space/keeporg.git
+
+Builds:
+  - versionName: 0.1.0
+    versionCode: 1
+    commit: v0.1.0-android
+    subdir: android/app
+    gradle:
+      - yes
+    output: android/app/build/outputs/apk/release/app-release-unsigned.apk
+
+AutoUpdateMode: None
+UpdateCheckMode: Tags
+CurrentVersion: 0.1.0
+CurrentVersionCode: 1