Fix the Android release build and tighten the Helm values

Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26,
the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME
was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle
daemon on JDK 17 whatever launches it.

The Helm values trusted every private address range as a proxy, which let
any client on the LAN choose its own address for the sign-in rate limits.
They now name only the nginx host and the k3s pod network. The port gains
healthcheckPath, so the pod gets readiness and liveness probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

android/gradle/gradle-daemon-jvm.properties

@@ -0,0 +1,5 @@
+# The Gradle daemon runs on JDK 17 whatever the launcher runs on. AGP 8.7's
+# lint, which every release build runs (lintVitalAnalyzeRelease), cannot
+# parse the version string of newer JDKs, and a Gradle installed from
+# Homebrew launches on the newest one.
+toolchainVersion=17