Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

packaging/deb/changelog

@@ -0,0 +1,11 @@
+keeporg (0.1.0) unstable; urgency=medium
+
+  * First release.
+  * keeporgd: synchronization server with nested group access control,
+    invite-link and OIDC registration, built-in TOTP second factor,
+    versioned KDBX blobs and server-sent update notifications.
+  * keeporg: desktop client that mirrors assigned databases as ordinary
+    .kdbx files, pushes every save and applies remote changes, with
+    server-wins, client-wins and manual merge strategies.
+
+ -- tiredsysadmin <rcmd@garage.rcmd.space>  Thu, 29 Oct 2026 12:00:00 +0000

packaging/deb/client/control.in

@@ -0,0 +1,17 @@
+Package: keeporg
+Version: @VERSION@
+Section: utils
+Priority: optional
+Architecture: @ARCH@
+Maintainer: tiredsysadmin <rcmd@garage.rcmd.space>
+Homepage: https://garage.rcmd.space/keeporg
+Description: KeePass database synchronization client
+ KeepOrg mirrors the KDBX databases a KeepOrg server has assigned to you into
+ one directory as ordinary files, so KeePassXC, KeePass2 or any compatible
+ application opens them directly.
+ .
+ Each save is pushed to the server and changes other people push are applied
+ locally. The client never opens a database and never sees a master password.
+ .
+ A systemd user unit is included: enable it with
+ `systemctl --user enable --now keeporg`.

packaging/deb/copyright

@@ -0,0 +1,14 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: keeporg
+Source: https://garage.rcmd.space/keeporg
+
+Files: *
+Copyright: 2026 tiredsysadmin
+License: AGPL-3.0-or-later
+ This program is free software: you can redistribute it and/or modify it under
+ the terms of the GNU Affero General Public License as published by the Free
+ Software Foundation, either version 3 of the License, or (at your option) any
+ later version.
+ .
+ On Debian systems the full text is in
+ /usr/share/common-licenses/AGPL-3.

packaging/deb/server/control.in

@@ -0,0 +1,19 @@
+Package: keeporgd
+Version: @VERSION@
+Section: net
+Priority: optional
+Architecture: @ARCH@
+Maintainer: tiredsysadmin <rcmd@garage.rcmd.space>
+Homepage: https://garage.rcmd.space/keeporg
+Depends: adduser
+Description: KeePass database synchronization server
+ KeepOrg stores KDBX files as opaque versioned blobs and arbitrates concurrent
+ writes between clients. It hosts many databases, controls access through a
+ tree of user groups, and accepts registrations by invite link or OIDC.
+ .
+ It never opens a database and cannot read one: master passwords stay on the
+ clients.
+ .
+ The service runs as the keeporg user with its data in /var/lib/keeporg and
+ its configuration in /etc/keeporg/server.json. Terminate TLS in front of it
+ with nginx or caddy, or point tls_cert and tls_key at a certificate.