Fix the Android release build and tighten the Helm values

Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26,
the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME
was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle
daemon on JDK 17 whatever launches it.

The Helm values trusted every private address range as a proxy, which let
any client on the LAN choose its own address for the sign-in rate limits.
They now name only the nginx host and the k3s pod network. The port gains
healthcheckPath, so the pod gets readiness and liveness probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/README.md

@@ -27,8 +27,9 @@ The merge policy in `Mirror.decide` is the same table as the desktop client's
 
 ## Building
 
-Requirements: JDK 17 (lint in AGP 8.7 fails on newer JDKs; set `JAVA_HOME`
-to a 17 when Gradle defaults to something else), Gradle 8.9 or newer, and an
+Requirements: a JDK 17 installed (Gradle 8.9 or newer runs its daemon on it
+whatever JDK launches Gradle, per `gradle/gradle-daemon-jvm.properties`:
+AGP 8.7's lint, which every release build runs, fails on newer JDKs), and an
 Android SDK with
 `platforms;android-35` and `build-tools;35.0.0`.