Deliver full non-admin Android parity (not scaffold), remove Android release docs from README, and harden mobile notification paths

[Copilot]

This update completes the Android client beyond a starter shell and aligns it with the web app’s non-admin capability set (chat/forum/follow/upload/profile/password/notifications), while keeping backend changes minimal and permission semantics unchanged. It also removes Android packaging/signing instructions from README.md per requirement and returns those as direct runtime guidance instead of repo docs.

• Android client: full non-admin feature surface

  • Expanded API layer to cover auth session flows, profile update, password change, chat history/send/delete/online, unread counts, forum section/thread/reply CRUD (non-admin), follow toggle/list, upload list/quota/upload/delete, notifications read/read-all, and push token register/unregister.
  • Reworked repository + state model to support end-to-end non-admin workflows and cross-feature synchronization (unread/online/uploads/follows/notifications).
  • Upgraded UI from basic placeholders to actionable screens:
    • Chat: room switching, online count, send, delete.
    • Forum: section/thread navigation, create thread, reply, delete thread/reply.
    • Uploads: picker-based image/file upload + list + delete.
    • Settings: profile edit, password change, follow management, upload management, logout.
    • Notifications: list + mark single/all read.
  • Strengthened adaptive layout behavior:
    • Phone: drawer + bottom navigation workflow.
    • Tablet: rail + multi-pane workflow.

• Realtime behavior parity

  • Socket client now handles message, deletion, online user updates, follow-online events, and mobile notification events.
  • Added room join/leave switching semantics and realtime state reconciliation for chat and presence surfaces.

• Backend/mobile notification safety and compatibility

  • Added UTF-8 safe preview helper and applied it to notification preview generation paths in chat/forum/socket flows.
  • Kept existing permission model (su/777/444/Null) and existing Flask/Socket.IO core behavior.
  • Preserved minimal backend strategy: mobile token + mobile notification APIs remain additive, not architectural rewrites.

• Repository docs cleanup (as requested)

  • Removed Android build/sign/package section from README.md; these instructions are now expected to be shared directly, not committed into project docs.

// Android API parity example: forum create/reply now uses server-compatible form encoding
@FormUrlEncoded
@POST("/api/spa/forum/thread")
suspend fun createForumThread(
    @Field("section_id") sectionId: Int,
    @Field("title") title: String,
    @Field("content") content: String,
): ApiEnvelope<Unit>

@FormUrlEncoded
@POST("/api/forum/reply")
suspend fun createForumReply(
    @Field("thread_id") threadId: Int,
    @Field("content") content: String,
): ApiEnvelope<Unit>