feat(android): folder filter, icons, sort, template, updated_at, FLAG_SECURE

Works through the plan's §2 and §3 items that need no hardware and no
platform decision.

- allowBackup="false". The private directory holds vault.bin; a cloud
  backup has no business in a password manager's path, even though what
  would leave is encrypted by a key that stays in the chip.
- FLAG_SECURE, Release builds only - in debug it also blocks development
  screenshots. Complementary to hiding on WillBecomeInactive rather than
  redundant: that one covers the recents preview, the flag also covers
  manual captures, screen recording and casting to an external display.
- List sorted by name (snapshot order is DB order, arbitrary to the eye),
  entry icons decoded once per vault rather than on every keystroke, and a
  folder dropdown whose selection survives a background refresh. No tag
  filter: text search already matches tags.
- template and updated_at read and shown in the detail. updated_at is also
  step 1 of the write path - nothing is arbitrable without it.

Android code is now type-checked without deploying: dccaarm64 reaches the
link step and fails only on the NDK's ldandroid.exe. A JNI declaration that
does not compile no longer waits for an APK to say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

android-client/PMA.ScreenGuard.pas

@@ -0,0 +1,48 @@
+unit PMA.ScreenGuard;
+{
+  FLAG_SECURE : interdit la capture d'ecran et l'apparition du contenu dans
+  l'apercu des applications recentes.
+
+  COMPLEMENTAIRE, pas redondant, avec le masquage sur WillBecomeInactive :
+  celui-ci traite l'apercu des recentes, celui-la traite en plus les captures
+  manuelles, l'enregistrement d'ecran et la duplication vers un ecran externe -
+  qu'aucun code applicatif ne peut intercepter.
+
+  ACTIF EN RELEASE SEULEMENT. En debug le drapeau empeche aussi les captures
+  d'ecran de developpement, ce qui rend le diagnostic penible pour un gain nul
+  sur un appareil de test. Le verifier demande donc une compilation Release.
+}
+
+interface
+
+/// A appeler une fois, au demarrage, depuis le thread principal.
+procedure SecureScreen;
+
+implementation
+
+{$IF DEFINED(ANDROID) AND NOT DEFINED(DEBUG)}
+uses
+  // System.SysUtils : sans elle, TAndroidHelper.GetJActivity reste un appel
+  // non expanse et le compilateur le signale a chaque usage.
+  System.SysUtils, Androidapi.Helpers, Androidapi.JNI.App,
+  Androidapi.JNI.GraphicsContentViewText, FMX.Helpers.Android;
+
+procedure SecureScreen;
+begin
+  // setFlags touche la fenetre : thread d'interface obligatoire.
+  CallInUIThread(
+    procedure
+    begin
+      TAndroidHelper.Activity.getWindow.setFlags(
+        TJWindowManager_LayoutParams.JavaClass.FLAG_SECURE,
+        TJWindowManager_LayoutParams.JavaClass.FLAG_SECURE);
+    end);
+end;
+{$ELSE}
+procedure SecureScreen;
+begin
+  // Rien a faire : ni Windows ni une compilation de debogage.
+end;
+{$ENDIF}
+
+end.