fix(android): offline changes survive a refresh, and a restart

Two defects in what offline saving had just introduced, both losing data
silently - found by re-reading rather than by testing, since the device was
away.

The background refresh REPLACED the cache with the repository's version. An
edit made offline vanished at the next fetch, without a word, which is
exactly what offline saving promises to prevent. It merges now, and keeps the
flag: merging is not publishing.

And the flag lived only in memory. An application killed between the offline
save and the publish forgot it had anything to send - and the next refresh
then clobbered the cache. It is a file now, read before any refresh can run.

A file rather than a field of the sealed cache: the flag carries no secret,
its whole content is yes or no, and the cache's signature is already nine
parameters long.

mainApk.pas

@@ -390,6 +390,9 @@ begin
        IFMXApplicationEventService, LEvents) then
     LEvents.SetApplicationEventHandler(HandleAppEvent);
 
+  // AVANT TOUT RAFRAICHISSEMENT : sans cela le premier tirage remplacerait le
+  // cache par la version du depot, et ce qui attend ici serait perdu.
+  FPending := HasPendingFlag;
   PushConfig;
   ShowUnlock;
 {$IFNDEF DEBUG}
@@ -976,6 +979,7 @@ begin
           end;
           AdoptVault(LNew);
           FPending := not LPublished;
+          SetPendingFlag(FPending);
           WebCall(Format('PM.setPending(%s)',
             [LowerCase(BoolToStr(FPending, True))]));
           if LPublished then
@@ -1141,6 +1145,7 @@ begin
           if LDone then
           begin
             FPending := False;
+            SetPendingFlag(False);
             AdoptVault(LMerged);
             Log('pending changes published, new sha ' + FETag);
             WebCall('PM.setPending(false)');
@@ -1930,6 +1935,8 @@ begin
       end;
     end;
 
+    WebCall(Format('PM.setPending(%s)',
+      [LowerCase(BoolToStr(FPending, True))]));
     try
       LSw := TStopwatch.StartNew;
       AdoptVault(LPlain);
@@ -2286,6 +2293,18 @@ begin
         FETag := LRes.ETag;
         Log('  decrypted in ' + LSw.ElapsedMilliseconds.ToString + ' ms');
 
+        // CE QUI ATTEND ICI NE SE FAIT PAS ECRASER. Le rafraichissement
+        // remplacait le cache par la version du depot : une modification faite
+        // hors connexion disparaissait alors sans un mot, et c'est exactement
+        // ce que l'enregistrement hors ligne promet d'eviter.
+        //
+        // On garde le drapeau : fondre ne publie pas.
+        if FPending and (FPlain <> '') then
+        begin
+          LPlain := MergeSnapshots(FPlain, LPlain);
+          Log('  merged with what is waiting here - still to publish');
+        end;
+
         // Ecrit APRES un dechiffrement reussi seulement, et avec son ETag :
         // les deux doivent rester coherents.
         try