Add Android client, packaging, Makefile entrypoint and handover docs

Why: the set has to be installable and publishable, not just buildable, and
the next person needs the reasoning, not only the code.

What:
- android/: Kotlin client with no third-party dependencies. A
  DocumentsProvider publishes the mirrored databases to every file picker, so
  KeePassDX opens them as ordinary documents; closing a file it wrote
  triggers a sync. A foreground service holds the event stream open.
  Mirror.decide transcribes the Go merge table, so both platforms resolve a
  conflict identically.
- Makefile as the single entrypoint, with file targets so only what changed
  is rebuilt: host and cross builds, both .deb packages, the macOS DMG with
  its /Applications symlink, the Windows zip, the APK under its F-Droid
  publishing name, and manual-only android-publish.
- versions.mk holds one version per platform plus the Android versionCode;
  `make bump` and `make changelog` move them. Debian changelog is tracked.
- systemd units (hardened system unit for the server, user unit for the
  agent), macOS bundle and launch agent, Windows Task Scheduler job.
- docs/HANDOVER.md on architecture and every decision that shaped it,
  docs/PROTOCOL.md for the API, README for the quick start.

Proved: make check and make test-race both pass; built both .deb packages and
inspected their contents, built the Windows zip, cross-compiled all five
desktop targets, and exercised make bump. The Android module is written but
not compiled: no JDK or Android SDK in this environment, which HANDOVER.md
states plainly.

scripts/changelog.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# Prepend an entry to the Debian changelog.
+#   changelog.sh <version> "what changed"
+set -eu
+
+version=${1:-}
+message=${2:-}
+root=$(cd "$(dirname "$0")/.." && pwd)
+file=$root/packaging/deb/changelog
+
+if [ -z "$version" ] || [ -z "$message" ]; then
+	echo 'usage: make changelog MSG="what changed"' >&2
+	exit 2
+fi
+
+author=${DEBFULLNAME:-tiredsysadmin}
+email=${DEBEMAIL:-rcmd@garage.rcmd.space}
+tmp=$(mktemp)
+{
+	printf 'keeporg (%s) unstable; urgency=medium\n\n' "$version"
+	printf '  * %s\n\n' "$message"
+	printf ' -- %s <%s>  %s\n\n' "$author" "$email" "$(date -R)"
+	cat "$file"
+} > "$tmp"
+mv "$tmp" "$file"
+printf 'added %s to %s\n' "$version" "$file"