feat(android): folder filter, icons, sort, template, updated_at, FLAG_SECURE

Works through the plan's §2 and §3 items that need no hardware and no
platform decision.

- allowBackup="false". The private directory holds vault.bin; a cloud
  backup has no business in a password manager's path, even though what
  would leave is encrypted by a key that stays in the chip.
- FLAG_SECURE, Release builds only - in debug it also blocks development
  screenshots. Complementary to hiding on WillBecomeInactive rather than
  redundant: that one covers the recents preview, the flag also covers
  manual captures, screen recording and casting to an external display.
- List sorted by name (snapshot order is DB order, arbitrary to the eye),
  entry icons decoded once per vault rather than on every keystroke, and a
  folder dropdown whose selection survives a background refresh. No tag
  filter: text search already matches tags.
- template and updated_at read and shown in the detail. updated_at is also
  step 1 of the write path - nothing is arbitrable without it.

Android code is now type-checked without deploying: dccaarm64 reaches the
link step and fails only on the NDK's ldandroid.exe. A JNI declaration that
does not compile no longer waits for an APK to say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pmserverApk.dpr

@@ -10,7 +10,8 @@ uses
   PMA.Store in 'android-client\PMA.Store.pas',
   PMA.Biometric in 'android-client\PMA.Biometric.pas',
   PMA.Vault in 'android-client\PMA.Vault.pas',
-  PMA.Totp in 'android-client\PMA.Totp.pas';
+  PMA.Totp in 'android-client\PMA.Totp.pas',
+  PMA.ScreenGuard in 'android-client\PMA.ScreenGuard.pas';
 
 {$R *.res}