Fix the Android release build and tighten the Helm values

Every Android release build runs lint, which AGP 8.7 cannot run on JDK 26,
the JDK Homebrew's Gradle starts on; make android failed unless JAVA_HOME
was set by hand. gradle/gradle-daemon-jvm.properties now runs the Gradle
daemon on JDK 17 whatever launches it.

The Helm values trusted every private address range as a proxy, which let
any client on the LAN choose its own address for the sign-in rate limits.
They now name only the nginx host and the k3s pod network. The port gains
healthcheckPath, so the pod gets readiness and liveness probes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/HANDOVER.md

@@ -846,6 +846,13 @@ key arrives as the Kubernetes secret `keeporg-encryption` mounted on
 at it. `KEEPORG_EXTERNAL_URL=https://keeporg.tiredsysadmin.cc` matches the
 nginx `server_name`; the image's command passes neither `-config` nor
 `-url`, so this variable is the only thing that sets it there.
+`KEEPORG_TRUSTED_PROXIES` names only the nginx host (10.200.1.3) and the k3s
+pod network (10.42.0.0/16, the source address after kube-proxy's NodePort
+translation); a wider range would let clients on it choose their own address
+for the rate limits. The port's `healthcheckPath: /healthz` gives the pod
+readiness and liveness probes. The `keeporg-encryption` secret's
+`config.txt` must be the master key itself — base64 of 32 bytes, or 32 raw
+bytes — since 0.11 refuses to start without one.
 `KEEPORG_ADMIN_PASSWORD` is not set there, so the first start logs a
 generated password once.