feat(android): read the snapshot from a Gitea repo, and close cleartext

PMA.SyncClient now speaks two transports, told apart by the URL:
/api/v1/repos/ means the Gitea contents API, anything else the old PHP
endpoint. The PHP path stays until the Windows side publishes to the repo
too - without it the migration would need both ends flipped at once, with
no way back.

Three things differ on the Gitea side and nothing else: the header is
"token <PAT>" not "Bearer" (swapping them gives a silent 401), the body is
JSON carrying base64 content, and the fingerprint comparison happens in the
client since the API has no If-None-Match. The body is re-downloaded, which
is cheap; the four-second key derivation is still avoided. The result's
ETag field carries the sha, so the caller cannot tell which transport
answered.

usesCleartextTraffic is replaced by a network config that permits cleartext
to 127.0.0.1 and localhost BY NAME and forbids it everywhere else. The
attribute drew no such line: a mistyped URL sent the bearer token over the
network in the clear with nothing to signal it. Now it fails immediately,
which is the behaviour worth having.

Verified in the built APK: res/xml/network_security_config.xml is present
and the manifest attribute resolves to a real resource id. NOT verified
against a real repo - that needs a private repo, a published
vault-sync.json and a token, none of which exist yet.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

AndroidManifest.template.xml

@@ -19,12 +19,13 @@
     <queries>
 <%queries-child-elements%>
     </queries>
-    <!-- usesCleartextTraffic : TEST UNIQUEMENT. Android bloque le trafic en
-         clair depuis la version 9, y compris vers 127.0.0.1 ; sans cet
-         attribut l'essai local via "adb reverse" echoue avec une erreur
-         reseau opaque. A RETIRER avant diffusion : l'endpoint de production
-         est en HTTPS, et le jeton Bearer circule dans un en-tete a chaque
-         appel. -->
+    <!-- networkSecurityConfig REMPLACE usesCleartextTraffic="true", qui
+         autorisait le clair vers n'importe quel hote pour la seule raison que
+         l'essai local via "adb reverse" parle HTTP. La configuration ne
+         l'autorise plus que vers la boucle locale, nommement : le jeton ne
+         peut plus sortir qu'en TLS, et une URL http:// vers un vrai hote
+         echoue bruyamment au lieu de le laisser passer en clair.
+         Voir android-client/android-res/xml/network_security_config.xml. -->
     <!-- allowBackup=false : le repertoire prive contient vault.bin, c'est-a-dire
          le coffre entier. Il est chiffre par une cle qui ne quitte pas la puce,
          donc ce qui sortirait serait inexploitable - mais il sortirait, et une
@@ -33,7 +34,7 @@
          necessaires une fois la sauvegarde refusee en bloc. -->
     <application
         android:allowBackup="false"
-        android:usesCleartextTraffic="true"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:persistent="%persistent%"
         android:restoreAnyVersion="%restoreAnyVersion%"
         android:label="%label%"