feat(android): the write transport, and an error that says why

TSyncClient.Put publishes a container to the Gitea contents API: token header,
JSON envelope with the file base64 inside, sha omitted rather than empty when
creating, branch omitted so the repo default is used. 409 becomes its own
status, ssConflict, because it means re-read and re-apply rather than retry.

The first PUT is where a mistake costs data, so the probe writes to
write-test.json rather than the vault. Same repository, same token, same
envelope, same concurrency check - and the vault is never at stake. Reachable
from a debug-only button; the page asks Delphi whether to show it.

Two mistakes of mine on the way, both about replacing information with a guess:

- the probe did not push the config first, unlike Sync, so a token that had
  just been pasted had not reached Delphi and the 403 blamed the wrong thing.
- 401 and 403 were rewritten as "token lacks write access", discarding Gitea's
  body. That is an interpretation, not an observation: the same code covers a
  read-only repository, a protected branch, a token from another account. The
  body says which - here, plainly, "token scope=read:repository".

Also recorded: the sha comparison now short-circuits (304 where it used to
decrypt), so the difference was case or whitespace, absorbed by SameText on
trimmed values. The offending character itself was never seen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

android-client/web/app.html

@@ -214,6 +214,10 @@
         <button class="btn" id="btnCfg">&#9881;&nbsp; Server settings</button>
         <button class="btn" id="btnLog">&#8801;&nbsp; Log</button>
       </div>
+      <!-- Essai du chemin d'ecriture, visible uniquement en build de debogage :
+           Delphi appelle PM.setDebug(true). Il ecrit dans un AUTRE fichier du
+           depot, jamais dans le coffre. -->
+      <button class="btn wide" id="btnWriteTest" hidden>Write test (debug)</button>
     </div>
     <div id="cfg" hidden>
       <input class="field-in" id="url" placeholder="endpoint URL"
@@ -341,6 +345,14 @@ document.getElementById('btnLog').addEventListener('click', function () {
   var l = document.getElementById('log');
   l.hidden = !l.hidden;
 });
+document.getElementById('btnWriteTest').addEventListener('click', function () {
+  // pushConfig D'ABORD, comme Sync. Sans cela, un jeton qui vient d'etre colle
+  // et dont le champ n'a pas encore perdu le focus n'est pas parti vers Delphi,
+  // qui agit alors avec l'ancien - et rend un 403 parfaitement trompeur.
+  pushConfig();
+  document.getElementById('log').hidden = false;
+  send('writetest');
+});
 
 function esc(s) {
   return String(s == null ? '' : s).replace(/[&<>"]/g, function (c) {
@@ -500,6 +512,9 @@ var PM = {
     renderRows();
   },
 
+  setDebug: function (on) {
+    document.getElementById('btnWriteTest').hidden = !on;
+  },
   showUnlock: function () {
     document.body.classList.remove('on-list', 'on-detail', 'searching');
     view = 'unlock';