Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

scripts/build-dmg.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Build the macOS disk image: an application bundle beside a symlink to
+# /Applications, which is what a user expects to drag.
+#   build-dmg.sh <version> <arch> <appid> <output.dmg>
+set -eu
+
+version=$1
+arch=$2
+appid=$3
+out=$4
+
+if [ "$(uname -s)" != Darwin ]; then
+	echo "build-dmg.sh: a DMG can only be built on macOS (hdiutil is required)" >&2
+	echo "the binary itself cross-compiles: make build/darwin-$arch/keeporg" >&2
+	exit 1
+fi
+
+root=$(cd "$(dirname "$0")/.." && pwd)
+stage=$root/build/dmg-$arch
+app=$stage/KeepOrg.app
+rm -rf "$stage"
+mkdir -p "$app/Contents/MacOS" "$app/Contents/Resources"
+
+install -m 0755 "$root/build/darwin-$arch/keeporg" "$app/Contents/MacOS/keeporg"
+sed -e "s/@VERSION@/$version/" -e "s/@APPID@/$appid/" \
+	"$root/packaging/macos/Info.plist.in" > "$app/Contents/Info.plist"
+install -m 0755 "$root/packaging/macos/launcher.sh" "$app/Contents/MacOS/KeepOrg"
+sed -e "s/@APPID@/$appid/" "$root/packaging/macos/launch-agent.plist.in" \
+	> "$app/Contents/Resources/$appid.plist"
+cp "$root/docs/HANDOVER.md" "$stage/Read me first.md" 2>/dev/null || true
+
+# The symlink every macOS DMG carries, so installing is one drag.
+ln -s /Applications "$stage/Applications"
+
+mkdir -p "$(dirname "$out")"
+rm -f "$out"
+hdiutil create -volname "KeepOrg $version" -srcfolder "$stage" \
+	-ov -fs HFS+ -format UDZO "$out" >/dev/null
+printf 'built %s\n' "$out"