android: scaffold the Tauri mobile lane and build a debug APK in CI

The phone client is Tauri v2 mobile (operator decision), so it reuses the Vue
frontend and the Rust store and sync engine that already exist rather than
becoming a third implementation to keep in step by hand.

gen/android is committed. tauri android init generated it, its own .gitignore
already excludes the build outputs and every keystore file, and CI must not have
to regenerate a project that manifest edits will accumulate in.

What the scaffold confirms is that the image's JDK pin was load-bearing rather
than incidental: Tauri templated Gradle 8.14.3 with AGP 8.11.0, and CI-android's
versions.env records that JDK 25 needs Gradle 9.1.0+ and that anything older
fails with an opaque "25.0.3" message. Picking 17 for ci-tauri-android avoided
exactly that. namespace and applicationId came out as com.fabledsword.thoughtsync,
matching the desktop identifier, so the app-data story stays consistent.

The lane builds a DEBUG APK for arm64 only. Release APKs need signing, and the
keystore has to be generated by the operator and never pass through CI logs or an
agent session — the constraint recorded for the updater key applies unchanged.
Gradle's throwaway debug keystore needs nothing from anyone, so this can prove the
app compiles and packages today and grow a signed job when a key exists. arm64 is
every real device; the image carries the other three ABIs, so widening is a word.

Triggered by frontend/** as well as desktop/**, because generate_context! compiles
the frontend into the app — the same reasoning that widened desktop.yml. Android,
desktop and web are peers on one quality bar, and a frontend commit that skipped
this lane would ship a stale phone build.

Green here will mean it BUILT. A Linux runner cannot execute an APK, so nothing in
this lane proves the app runs, renders, or is usable by finger.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci-requirements.md

@@ -159,6 +159,42 @@ backend/frontend push.
 - No Postgres lane (unchanged): the desktop app's local store + sync behavior is
   verified on the operator's machine, not in CI.
 
+## Android (Tauri mobile) lane — `android.yml`, third image
+
+Android is a peer surface, not a desktop variant, so it gets its own workflow.
+
+- **Image:** `git.fabledsword.com/bvandeusen/ci-tauri-android:1.97` (Rust + the
+  four Android ABIs + Android SDK/NDK + JDK 17 + Node + tauri-cli). Pins held in
+  lockstep with `ci-tauri` and `ci-tauri-win` — all three compile the same crate.
+- **Why a third image.** `ci-android` says in its own header that it excludes the
+  NDK ("No Flutter, no NDK, no CMake") and carries no Rust; `ci-tauri` has Rust
+  but no SDK, plus a WebKitGTK stack Android never touches. Tauri needs the NDK
+  precisely because the core is Rust compiled to Android ABIs.
+- **JDK 17, not the 25 `ci-android`/`ci-flutter` ship.** `tauri android init`
+  GENERATES the Gradle project, so its version isn't ours to choose — it produced
+  Gradle **8.14.3** + AGP **8.11.0** here. `CI-android/versions.env` records that
+  JDK 25 needs Gradle 9.1.0+ and that anything older fails with an opaque
+  `"25.0.3"` message. Bumping this JDK without checking what Tauri templates will
+  break the build with an error that names nothing useful.
+- **`gen/android/` is COMMITTED.** `tauri android init` generates it, and the only
+  ignores are its own (build outputs, `local.properties`, `key.properties`,
+  `keystore.properties`). CI must not have to regenerate it, and manifest or
+  Gradle edits have to survive.
+- **Debug APK only, arm64 only, today.** A release APK must be signed, and the
+  keystore has to be generated by the operator and never pass through CI logs or
+  an agent session — the same constraint recorded for the updater key (task 2136).
+  Gradle's throwaway debug keystore needs nothing from anyone, so this lane proves
+  the app compiles and packages. arm64 is every real device; the image carries the
+  other three ABIs, so widening is a one-word change.
+- **Green means it BUILT.** Like the Windows lane, a Linux runner cannot execute
+  the artifact. Nothing here proves the app runs, renders, or is usable by finger.
+- **TLS is the likely first failure.** `reqwest` is pinned to `native-tls`, which
+  is deliberate for the Windows lane (it resolves to `schannel`, keeping C/asm out
+  of the cross-compile). On Android it resolves to **OpenSSL**, which must be
+  cross-compiled per ABI — hence `perl` + `make` in the image. If that proves
+  painful, the fix is a target-specific dependency block selecting `rustls` for
+  Android only, leaving the Windows lane's reasoning untouched.
+
 ## Formatting the Rust lane before pushing
 
 `cargo fmt --check` runs in CI and had failed on four consecutive desktop pushes