Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

scripts/bump.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+# Bump one platform's semantic version in versions.mk.
+#   bump.sh <server|linux|macos|windows|bsd|android|all> <major|minor|patch>
+# Bumping android also increments its monotonic versionCode.
+set -eu
+
+platform=${1:-}
+part=${2:-patch}
+root=$(cd "$(dirname "$0")/.." && pwd)
+file=$root/versions.mk
+
+case $platform in
+server|linux|macos|windows|bsd|android|all) ;;
+*)
+	echo "usage: make bump PLATFORM=<server|linux|macos|windows|bsd|android|all> PART=<major|minor|patch>" >&2
+	exit 2
+	;;
+esac
+case $part in
+major|minor|patch) ;;
+*)
+	echo "bump.sh: PART must be major, minor or patch" >&2
+	exit 2
+	;;
+esac
+
+bump_one() {
+	key=VERSION_$(echo "$1" | tr 'a-z' 'A-Z')
+	current=$(sed -n "s/^$key[[:space:]]*:=[[:space:]]*\([0-9.]*\).*/\1/p" "$file")
+	[ -n "$current" ] || { echo "bump.sh: $key not found in versions.mk" >&2; exit 1; }
+	major=$(echo "$current" | cut -d. -f1)
+	minor=$(echo "$current" | cut -d. -f2)
+	patch=$(echo "$current" | cut -d. -f3)
+	case $part in
+	major) major=$((major + 1)); minor=0; patch=0 ;;
+	minor) minor=$((minor + 1)); patch=0 ;;
+	patch) patch=$((patch + 1)) ;;
+	esac
+	next=$major.$minor.$patch
+	sed -i.bak "s/^$key[[:space:]]*:=.*/$(printf '%-16s := %s' "$key" "$next")/" "$file"
+	printf '%s %s -> %s\n' "$1" "$current" "$next"
+	if [ "$1" = android ]; then
+		code=$(sed -n 's/^ANDROID_VERSION_CODE[[:space:]]*:=[[:space:]]*\([0-9]*\).*/\1/p' "$file")
+		sed -i.bak "s/^ANDROID_VERSION_CODE[[:space:]]*:=.*/ANDROID_VERSION_CODE := $((code + 1))/" "$file"
+		printf 'android versionCode %s -> %s\n' "$code" "$((code + 1))"
+	fi
+}
+
+if [ "$platform" = all ]; then
+	for p in server linux macos windows bsd android; do bump_one "$p"; done
+else
+	bump_one "$platform"
+fi
+rm -f "$file.bak"