feat(android): HTTP client for the sync endpoint, with ETag reuse

Fetches the opaque container and the ETag; a 304 skips both the download and the 4-second derivation, which is the whole point of keeping the tag between calls. Redirects are not followed - one to another host would send the bearer token there.

Local testing goes through adb reverse tcp:8080 tcp:80, which makes the phone reach the PC as 127.0.0.1 and satisfies the endpoint's loopback exemption. That needs usesCleartextTraffic in the manifest, marked for removal before shipping.

pmserverApk.dpr

@@ -5,7 +5,8 @@ uses
   FMX.Forms,
   mainApk in 'mainApk.pas' {Form8},
   PMA.Crypto in 'android-client\PMA.Crypto.pas',
-  PMA.TestVector in 'android-client\PMA.TestVector.pas';
+  PMA.TestVector in 'android-client\PMA.TestVector.pas',
+  PMA.SyncClient in 'android-client\PMA.SyncClient.pas';
 
 {$R *.res}