Prepare Android release artifacts and listing (#112)

Add Rust distribution auditing, pinned post-build AAB signing, complete offline third-party notices, an Android privacy policy and reviewable Play listing assets. Preserve the application ID and audit both ARM ABIs, native symbols, baseline profiles and R8 mapping.

Fix dialog focus ownership, navigation-triggered cleanup loops and stale authentication errors after first-run setup, with native and real-activity regressions.

Google Play publication is deferred by the user. Issue #112 remains open for production signing, Console declarations and actual Play install/update verification.

android/play/listing.toml

@@ -0,0 +1,37 @@
+# Draft listing; publication and the IARC questionnaire are still pending.
+locale = "en-US"
+title = "IronStorage"
+short_description = "Local-first pass-compatible passwords, TOTP, Autofill and HTTPS Git sync."
+category = "PRODUCTIVITY"
+contains_ads = false
+support_url = "https://git.rfc1437.de/hugo/IronStorage/issues"
+privacy_url = "https://git.rfc1437.de/hugo/IronStorage/src/branch/main/android/features/src/main/res/raw/privacy.txt"
+full_description = """
+Keep control of your password store. IronStorage works locally with the standard
+pass repository format: GPG-encrypted entries in a Git repository.
+
+Create a local store or connect your own HTTPS Git server. Browse folders, search
+entries, generate passwords, edit credentials and synchronize changes. Configure
+your own GPG recipients and Git identity. IronStorage does not require an
+IronStorage account or operate a password-storage service.
+
+Use time-based one-time passwords, including cached discovery and search while
+the store is locked. Optional Android biometric unlock protects saved
+passphrases with Android Keystore. Enable Autofill in Android settings or, on
+Android 14 and later, select IronStorage as a Credential Manager provider.
+Credential selection remains under your control.
+
+Transfer compatible GPG key material through QR codes. Camera frames are
+processed on your device. Review the warning before exporting private keys.
+
+No advertising or analytics. Your optional HTTPS Git host receives your encrypted
+repository and unencrypted Git metadata; its administrator controls retention.
+Android cloud backup and device transfer are disabled. Uninstalling removes the
+local store and protected records: keep independent copies of the repository,
+GPG private keys and passphrases you need. Synchronization is not a substitute
+for a recovery plan.
+
+Requires Android 8.0 or later on ARM. Autofill and biometric availability depend
+on Android and device configuration. Credential Manager requires Android 14 or
+later. HTTPS Git is supported; SSH is not enabled in this Android release.
+"""