Make the Android app build, and fix what compiling it exposed

Why: the module was written but never compiled, so nothing about it was
proved. Building it found a name clash and a theme that would have crashed
every device below Android 10.

What:
- KeepOrgProvider.requireContext -> ctx(): ContentProvider gained
  requireContext() in API 30, and Kotlin refused the silent hiding.
- The application theme was @android:style/Theme.DeviceDefault.DayNight,
  which is API 29 while minSdk is 26. Replaced with @style/AppTheme, plain
  DeviceDefault in values/ and DayNight in values-v29/.
- Backup exclusions: data_extraction_rules.xml and backup_rules.xml exclude
  every domain for both cloud backup and device transfer. The session token
  authenticates as the user and the mirrored files are the organization's
  password databases; neither belongs in a backup.
- User-facing strings moved from code into strings.xml, so the app is
  translatable. Layouts stay in code, as before.
- mipmap-anydpi-v26 -> mipmap-anydpi (the qualifier is redundant at minSdk
  26), and the redundant activity label is gone.
- Lint is configured to write a text report, and `make android-lint` runs it;
  `make android` now fails with a clear message when ANDROID_HOME has no SDK.

Proved: the unsigned release APK builds (656 KB), lint reports "No issues
found", and the packaged DEX contains all 16 classes including every manifest
component. Toolchain used: JDK 21, Gradle 8.10.2, SDK platform 35 and
build-tools 35.0.0; on this arm64 host Google's x86-64 aapt2 runs under
qemu-user-static with amd64 multiarch libraries, which android/README.md now
documents. The app has still not run on a device: there is none here.

Makefile

@@ -135,14 +135,24 @@ $(ZIP): $(BUILD)/windows-amd64/keeporg.exe packaging/windows/README.txt
 # -------------------------------------------------------------------- android
 
 GRADLE ?= $(shell test -x android/gradlew && echo ./gradlew || echo gradle)
+# Gradle 8.9+ and JDK 17+ are required by the Android Gradle plugin.
+ANDROID_HOME ?= $(HOME)/android-sdk
 APK_BUILT := android/app/build/outputs/apk/release/app-release-unsigned.apk
 APK := $(DIST)/$(APPID_ANDROID)_$(ANDROID_VERSION_CODE).apk
 
 .PHONY: android
 android: $(APK) ## build the unsigned release APK under its publishing name
 
+.PHONY: android-lint
+android-lint: ## run Android lint; any finding fails the build
+	cd android && ANDROID_HOME="$(ANDROID_HOME)" $(GRADLE) --no-daemon :app:lintRelease
+	@cat android/app/build/reports/lint-results.txt
+
 $(APK): $(shell find android/app/src -type f 2>/dev/null) android/app/build.gradle.kts
-	cd android && $(GRADLE) --no-daemon assembleRelease \
+	@test -d "$(ANDROID_HOME)/platforms" || { \
+	  printf 'no Android SDK at %s\nset ANDROID_HOME, or see android/README.md\n' "$(ANDROID_HOME)" >&2; \
+	  exit 1; }
+	cd android && ANDROID_HOME="$(ANDROID_HOME)" $(GRADLE) --no-daemon assembleRelease \
 	  -PversionName=$(VERSION_ANDROID) -PversionCode=$(ANDROID_VERSION_CODE)
 	@mkdir -p $(DIST)
 	cp $(APK_BUILT) $@