feat(android): settings live on the device, dark theme, and the app is called Coffre

URL and token are no longer constants. They sit in settings.bin, sealed with the no-auth Keystore AES key - deliberately weaker than the vault: they must be readable to rebuild a vault that no longer exists, and a bearer token only opens ENCRYPTED data, worthless without the sync password that stays in the guarded vault. Retyping 64 hex characters after every cache purge was the real risk: the risk of writing them down elsewhere. They are saved only after a fetch that worked - proven settings, not typed ones.

The token and sync password moved to the gitignored local include, as first-run defaults only. Tracked source now carries no secret, and leaving them empty is a viable configuration: the app asks.

Theme: Delphi's Dark.style, copied into the repo and linked as a resource rather than deployed as a file - this project's deployment puts nothing beside the app, which is the same hole that forces the manifest and dex staging. A failure to load is never fatal; the default look is ugly but works.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

android-client/PMA.LocalConfig.template.inc

@@ -1,7 +1,14 @@
 // Modele. Copier en PMA.LocalConfig.inc (ignore par git) et remplir.
 //
-// Le mot de passe de sync ouvre TOUT le coffre une fois le conteneur
-// telecharge : il n'a rien a faire dans un depot, meme sans remote.
+// VALEURS DE PREMIER LANCEMENT SEULEMENT. Une fois que l'appareil a enregistre
+// ses reglages, elles ne sont plus lues. Laisser vide est parfaitement viable :
+// l'application demande alors de saisir jeton et mot de passe, ce qui est le
+// comportement d'une vraie installation.
+//
+// Le jeton authentifie l'appareil aupres de l'endpoint ; le mot de passe de
+// sync ouvre TOUT le coffre une fois le conteneur telecharge. Aucun des deux
+// n'a sa place dans un depot.
 
 const
+  FIRSTRUN_TOKEN = '';
   TEST_PWD = '';