feat(android): TOTP codes and custom fields in the detail screen

The detail screen showed site, username and password and silently dropped
everything else - custom fields, notes, 2FA. It is now built per entry
rather than from a fixed template: every row is a caption, a value, and
whether it is secret, so reveal and copy exist once instead of once per
kind of field.

Two rows stay special on purpose. A note's body is stored in the password
column, so it gets its own caption and no mask. The 2FA code is the only
live row - refreshed every second, placed first, since it is what you pull
a phone out for.

PMA.Totp takes bare base32 or an otpauth:// URI; both travel in snapshots
depending on how the entry was created. Checked against all six RFC 6238
vectors, including T=20000000000, which overflows 32 bits.

The rows hold plaintext, so clearing them is part of locking, not of
navigating away.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pmserverApk.dpr

@@ -9,7 +9,8 @@ uses
   PMA.SyncClient in 'android-client\PMA.SyncClient.pas',
   PMA.Store in 'android-client\PMA.Store.pas',
   PMA.Biometric in 'android-client\PMA.Biometric.pas',
-  PMA.Vault in 'android-client\PMA.Vault.pas';
+  PMA.Vault in 'android-client\PMA.Vault.pas',
+  PMA.Totp in 'android-client\PMA.Totp.pas';
 
 {$R *.res}