feat: add Android app and end-to-end encrypted library sync

Introduce the Kotlin/Compose Android companion app and extend the TMDB
proxy into a combo server that synchronizes the whole library as an
encrypted snapshot, with all three components (Go server, Android,
desktop) sharing one zero-knowledge crypto envelope and JSON schema.

- server: add PostgreSQL-backed /sync/library (GET/PUT) with optimistic
  concurrency (revision + 409 on conflict); sync stays disabled unless
  DATABASE_URL is set. Add docker-compose with Postgres.
- desktop: add libsodium CryptoEnvelope, LibrarySerializer and SyncClient;
  storage-mode and passphrase settings; a "Sync now" toolbar action with
  conflict resolution.
- android: Room-backed library with local/cloud storage modes, encrypted
  sync client, and settings UI. The proxy server (URL + token) can be
  configured as a TMDB proxy even in local-only mode.

Crypto is identical across platforms: Argon2id (libsodium crypto_pwhash,
INTERACTIVE) + XChaCha20-Poly1305 in a versioned "UMTS" envelope, so a
snapshot encrypted on one client decrypts on the other.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/main.go

@@ -27,6 +27,7 @@ type server struct {
 	verifier *oidc.IDTokenVerifier
 	oauth    oauth2.Config
 	client   *http.Client
+	store    *store // nil when DATABASE_URL is unset (sync disabled)
 }
 
 func main() {
@@ -55,6 +56,18 @@ func main() {
 		client: &http.Client{Timeout: 15 * time.Second},
 	}
 
+	if cfg.DatabaseURL != "" {
+		st, err := openStore(cfg.DatabaseURL)
+		if err != nil {
+			log.Fatalf("database connection failed: %v", err)
+		}
+		defer st.Close()
+		s.store = st
+		log.Printf("library sync enabled (PostgreSQL)")
+	} else {
+		log.Printf("library sync disabled (DATABASE_URL unset)")
+	}
+
 	mux := http.NewServeMux()
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte("ok"))
@@ -63,6 +76,7 @@ func main() {
 	mux.HandleFunc("/login", s.handleLogin)
 	mux.HandleFunc("/callback", s.handleCallback)
 	mux.HandleFunc("/3/", s.handleProxy)
+	mux.HandleFunc("/sync/library", s.handleSyncLibrary)
 
 	log.Printf("umt-tmdb-proxy listening on %s (public %s)", cfg.ListenAddr, cfg.PublicURL)
 	srv := &http.Server{