Fix the Android release build and tighten the Helm values

Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26,
the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME
was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle
daemon on JDK 17 whatever launches it.

The Helm values trusted every private address range as a proxy, which let
any client on the LAN choose its own address for the sign-in rate limits.
They now name only the nginx host and the k3s pod network. The port gains
healthcheckPath, so the pod gets readiness and liveness probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/variables/server.values.yaml

@@ -5,10 +5,13 @@ environment:
   value: "/etc/keeporg/config.txt"
 - name: "KEEPORG_EXTERNAL_URL"
   value: "https://keeporg.tiredsysadmin.cc"
-# nginx reaches the pod from the cluster's private network; its
-# X-Forwarded-For is what the sign-in rate limits count by.
+# Only the hops between nginx and the pod: the nginx host itself, and the
+# k3s pod network, which kube-proxy's NodePort translation makes the source
+# of every connection. Sign-in rate limits count by the address nginx puts
+# in X-Forwarded-For; a whole private range here would let any client on it
+# claim a fresh address with a header of its own.
 - name: "KEEPORG_TRUSTED_PROXIES"
-  value: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
+  value: "10.200.1.3,10.42.0.0/16"
 image:
   name: "repo.rcmd.space/keeporg"
   version: "v0.1.0"
@@ -18,6 +21,10 @@ network:
     node: 32970
     source: 8765
     destination: 8765
+    # Readiness keeps traffic away until the server has opened (and, on the
+    # first start of 0.11, imported) its database; liveness restarts it if
+    # it stops answering.
+    healthcheckPath: "/healthz"
 mounts:
   - name: "db"
     source: "/var/lib/keeporg"