Prepare Android release artifacts and listing (#112)

Add Rust distribution auditing, pinned post-build AAB signing, complete offline third-party notices, an Android privacy policy and reviewable Play listing assets. Preserve the application ID and audit both ARM ABIs, native symbols, baseline profiles and R8 mapping.

Fix dialog focus ownership, navigation-triggered cleanup loops and stale authentication errors after first-run setup, with native and real-activity regressions.

Google Play publication is deferred by the user. Issue #112 remains open for production signing, Console declarations and actual Play install/update verification.

android/README.md

@@ -70,17 +70,21 @@ only the facade, including typed native recovery states.
 ## Identity, signing and update
 
 All app build types keep de.rfc1437.ironstorage; test IDs are derived by AGP.
-Version code 1 and name 1.0.1 are deterministic initial metadata. Debug signing
-uses the standard local debug key. Release has no configured signing key and
-produces an unsigned APK; #112 configures protected upload signing. Do not add
+`release.properties` supplies Android version code 2 and name 1.0.1. Debug signing
+uses the standard local debug key. Ordinary release verification produces an
+unsigned APK/AAB. The separate [distribution command](../docs/android/distribution.md)
+signs the audited AAB with an external, certificate-pinned upload key after the
+build; signing passwords are excluded from Gradle and Cargo child processes. Do not add
 signing secrets or store passwords to the repository. Native symbol level FULL
 and the selected two ARM ABIs are packaged. Native runtime packaging is described
 below; no development network endpoint is included.
 
-The manifest exports the launcher and the reviewed AndroidX profile receiver
-protected by the privileged DUMP permission. Backup/cloud/device-transfer
+The manifest exports the launcher, the system-permission-protected Autofill and
+Credential Manager services, and the reviewed AndroidX profile receiver
+protected by the privileged DUMP permission. The credential picker is private.
+Backup/cloud/device-transfer
 exclusions and cleartext denial are explicit. Feature-specific services/permissions
-are added with their owning issues. Resources use values directories for future
+are audited by the artifact gates. Resources use values directories for future
 localization; vector/adaptive/monochrome icons and R8 consumer rules are present.
 The launcher uses an unchanged copy of the iPhone vault artwork from
 apple/Assets.xcassets/AppIcon.appiconset/AppIcon.png, inset for Android's adaptive