feat(android): folder filter, icons, sort, template, updated_at, FLAG_SECURE

Works through the plan's §2 and §3 items that need no hardware and no
platform decision.

- allowBackup="false". The private directory holds vault.bin; a cloud
  backup has no business in a password manager's path, even though what
  would leave is encrypted by a key that stays in the chip.
- FLAG_SECURE, Release builds only - in debug it also blocks development
  screenshots. Complementary to hiding on WillBecomeInactive rather than
  redundant: that one covers the recents preview, the flag also covers
  manual captures, screen recording and casting to an external display.
- List sorted by name (snapshot order is DB order, arbitrary to the eye),
  entry icons decoded once per vault rather than on every keystroke, and a
  folder dropdown whose selection survives a background refresh. No tag
  filter: text search already matches tags.
- template and updated_at read and shown in the detail. updated_at is also
  step 1 of the write path - nothing is arbitrable without it.

Android code is now type-checked without deploying: dccaarm64 reaches the
link step and fails only on the NDK's ldandroid.exe. A JNI declaration that
does not compile no longer waits for an APK to say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

AndroidManifest.template.xml

@@ -18,7 +18,14 @@
          reseau opaque. A RETIRER avant diffusion : l'endpoint de production
          est en HTTPS, et le jeton Bearer circule dans un en-tete a chaque
          appel. -->
+    <!-- allowBackup=false : le repertoire prive contient vault.bin, c'est-a-dire
+         le coffre entier. Il est chiffre par une cle qui ne quitte pas la puce,
+         donc ce qui sortirait serait inexploitable - mais il sortirait, et une
+         sauvegarde cloud n'a rien a faire dans le chemin d'un gestionnaire de
+         mots de passe. fullBackupContent et dataExtractionRules ne sont pas
+         necessaires une fois la sauvegarde refusee en bloc. -->
     <application
+        android:allowBackup="false"
         android:usesCleartextTraffic="true"
         android:persistent="%persistent%"
         android:restoreAnyVersion="%restoreAnyVersion%"