Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

packaging/macos/Info.plist.in

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleName</key>
+	<string>KeepOrg</string>
+	<key>CFBundleDisplayName</key>
+	<string>KeepOrg</string>
+	<key>CFBundleIdentifier</key>
+	<string>@APPID@</string>
+	<key>CFBundleVersion</key>
+	<string>@VERSION@</string>
+	<key>CFBundleShortVersionString</key>
+	<string>@VERSION@</string>
+	<key>CFBundlePackageType</key>
+	<string>APPL</string>
+	<key>CFBundleExecutable</key>
+	<string>KeepOrg</string>
+	<key>LSMinimumSystemVersion</key>
+	<string>11.0</string>
+	<!-- The agent has no window: it syncs in the background. -->
+	<key>LSUIElement</key>
+	<true/>
+	<key>NSHighResolutionCapable</key>
+	<true/>
+</dict>
+</plist>

packaging/macos/launch-agent.plist.in

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- Copy to ~/Library/LaunchAgents/@APPID@.plist and run
+     launchctl load ~/Library/LaunchAgents/@APPID@.plist
+     to keep the agent running after login. -->
+<plist version="1.0">
+<dict>
+	<key>Label</key>
+	<string>@APPID@</string>
+	<key>ProgramArguments</key>
+	<array>
+		<string>/Applications/KeepOrg.app/Contents/MacOS/keeporg</string>
+		<string>run</string>
+	</array>
+	<key>RunAtLoad</key>
+	<true/>
+	<key>KeepAlive</key>
+	<true/>
+	<key>StandardErrorPath</key>
+	<string>/tmp/keeporg.log</string>
+</dict>
+</plist>

packaging/macos/launcher.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Bundle executable: starts the synchronization agent. If this device has not
+# been signed in yet, open Terminal so the user can do it.
+set -eu
+here=$(cd "$(dirname "$0")" && pwd)
+keeporg="$here/keeporg"
+config="$HOME/Library/Application Support/keeporg/config.json"
+
+if [ ! -f "$config" ]; then
+	osascript -e "tell application \"Terminal\" to do script \"'$keeporg' login -server https://keeporg.example.com -user \$USER\"" \
+		-e 'tell application "Terminal" to activate'
+	exit 0
+fi
+exec "$keeporg" run