feat: add Android app and end-to-end encrypted library sync

Introduce the Kotlin/Compose Android companion app and extend the TMDB
proxy into a combo server that synchronizes the whole library as an
encrypted snapshot, with all three components (Go server, Android,
desktop) sharing one zero-knowledge crypto envelope and JSON schema.

- server: add PostgreSQL-backed /sync/library (GET/PUT) with optimistic
  concurrency (revision + 409 on conflict); sync stays disabled unless
  DATABASE_URL is set. Add docker-compose with Postgres.
- desktop: add libsodium CryptoEnvelope, LibrarySerializer and SyncClient;
  storage-mode and passphrase settings; a "Sync now" toolbar action with
  conflict resolution.
- android: Room-backed library with local/cloud storage modes, encrypted
  sync client, and settings UI. The proxy server (URL + token) can be
  configured as a TMDB proxy even in local-only mode.

Crypto is identical across platforms: Argon2id (libsodium crypto_pwhash,
INTERACTIVE) + XChaCha20-Poly1305 in a versioned "UMTS" envelope, so a
snapshot encrypted on one client decrypts on the other.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CMakeLists.txt

@@ -17,6 +17,13 @@ endif()
 
 find_package(Qt6 REQUIRED COMPONENTS Widgets Network Sql Svg Concurrent)
 
+# libsodium provides the cross-platform crypto primitives (Argon2id +
+# XChaCha20-Poly1305) used for the end-to-end encrypted library sync. It is
+# located via pkg-config (available on Linux and MSYS2/mingw for the Windows
+# build), which matches the byte-for-byte envelope used by the Android client.
+find_package(PkgConfig REQUIRED)
+pkg_check_modules(SODIUM REQUIRED IMPORTED_TARGET libsodium)
+
 qt_standard_project_setup()
 
 set(SOURCES
@@ -68,6 +75,13 @@ set(SOURCES
     src/ui/StarRating.h
     src/ui/StarRating.cpp
 
+    src/sync/CryptoEnvelope.h
+    src/sync/CryptoEnvelope.cpp
+    src/sync/LibrarySerializer.h
+    src/sync/LibrarySerializer.cpp
+    src/sync/SyncClient.h
+    src/sync/SyncClient.cpp
+
     resources/resources.qrc
 )
 
@@ -87,6 +101,7 @@ target_link_libraries(umt PRIVATE
     Qt6::Sql
     Qt6::Svg
     Qt6::Concurrent
+    PkgConfig::SODIUM
 )
 
 install(TARGETS umt