feat(android): keep the decrypted vault locally under an Android Keystore key

Opening a container costs ~4 s and the iteration count belongs to the desktop format, so the fix is to stop repeating it: derive once per snapshot, then read a local AES file which the hardware accelerates. The key is generated inside the Keystore and never leaves it - the file alone is useless, even rooted.

ETag and vault are encrypted together on purpose: an ETag outliving an unreadable vault would make the server answer 304 with nothing to show. A failed read wipes the cache rather than guessing.

Also normalises every Delphi source to pure ASCII: Delphi reads a BOM-less file as ANSI, so accented comments came back as mojibake, and each PowerShell rewrite added another layer.

pmserverApk.dpr

@@ -6,7 +6,8 @@ uses
   mainApk in 'mainApk.pas' {Form8},
   PMA.Crypto in 'android-client\PMA.Crypto.pas',
   PMA.TestVector in 'android-client\PMA.TestVector.pas',
-  PMA.SyncClient in 'android-client\PMA.SyncClient.pas';
+  PMA.SyncClient in 'android-client\PMA.SyncClient.pas',
+  PMA.Store in 'android-client\PMA.Store.pas';
 
 {$R *.res}