fix: package Android client from current source

[BrykmanHVD]

Summary

• make :app:copyApk build the current Android release and copy the exact Gradle output
• make package.bat fail when required Windows, Android, ADB, or installer artifacts are missing or cannot be copied
• make the packaged APK installer resolve paths reliably and explain Android signing conflicts
• document the QR -> TCP -> DeviceDescriptor -> device registration -> source selection -> RTSP diagnostic flow

Problem

The previous packaging flow could combine a newer Windows client with a stale APK:

• copyApk copied from the manually populated android/app/release/ directory
• it did not depend on assembleRelease
• package.bat reused whatever was already present in dist/

That mismatch has a misleading symptom: the phone reaches the control server on port 6969 and opens its camera, but the old APK does not send the DeviceDescriptor expected by the desktop client. The device is therefore not registered and RTSP video never starts.

Changes

copyApk now depends on assembleRelease and copies:

android/app/build/outputs/apk/release/app-release.apk

into:

dist/apk/app-release.apk

package.bat invokes this task before assembling the distributable directory and fails closed if required artifacts are absent.
It deletes the previous dist/apk/app-release.apk before invoking Gradle, so a
successful command that produces no APK cannot silently reuse a stale file.

Verification

• ./gradlew clean :app:copyApk :app:testReleaseUnitTest --stacktrace --console=plain
  • BUILD SUCCESSFUL
  • 59 tasks executed/up-to-date
• executed package.bat successfully with the real Windows dist/
• temporarily removed dist/VCamdroid.exe and confirmed package.bat exited with code 1 instead of reporting success
• temporarily removed a required installer script and confirmed packaging exited with
  code 1 before modifying the existing APK
• replaced dist/apk/app-release.apk with a 57-byte stale sentinel and confirmed
  package.bat deleted it and recreated the exact current Gradle artifact
• confirmed identical SHA-256 for the Gradle, dist, and final packaged APK:
  • 59d52e808004cb3f58521ede52e8c381eb25073e117b040b214685deb7c58907
• inspected the packaged DEX and confirmed DeviceDescriptor, sendDescriptor, and LogActivity are present while the legacy streamOriginal path is absent
• physical-device Wi-Fi test passed end to end: QR pairing, device listed on Windows, and live camera video received over RTSP

Signing note

The project currently uses its pre-existing debug signing configuration for the
release variant. Stable production updates require a maintainer-controlled signing
key used consistently across releases. This PR does not add or commit private key
material.

Related to #24 and #25.

The crash-handling work in #20 is intentionally not duplicated in this PR.