internaluploader: server + docs

One-way upload server: authentik SSO pairing (QR + app-initiated deep
link), hashed device tokens, streamed sha256-verified uploads into the
metube directory as <sha256>.<ext>.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

android/README.md

@@ -0,0 +1,52 @@
+# InternalUploader — Android app
+
+Native Kotlin app. Pair once (QR from the browser pairing page, or in-app SSO
+via a Custom Tab), then share anything to it — files upload in the background
+as `<sha256>.<ext>` and failed uploads retry until they land. No settings
+screen; the server address is baked in (`BuildConfig.DEFAULT_SERVER_URL`) and
+can be replaced only by what a pairing QR carries.
+
+## Building
+
+```sh
+JAVA_HOME=~/.jdks/jdk17 ./gradlew assembleRelease
+```
+
+- Needs an Android SDK at the path in `local.properties` (not committed;
+  `sdk.dir=$HOME/Android/Sdk`), platform android-36.
+- Gradle 8.14.3 (wrapper), AGP 8.11.1, Kotlin 2.1.21. The Gradle daemon needs
+  JDK 17–24 — the system `java` (25) is too new, hence the explicit
+  `JAVA_HOME`.
+- Output: `app/build/outputs/apk/release/app-release.apk`.
+
+## Release signing
+
+`app/build.gradle.kts` reads `~/.internaluploader/signing.properties`:
+
+```properties
+storeFile=/home/<you>/.internaluploader/release.p12
+storePassword=…
+keyAlias=internaluploader
+keyPassword=…
+```
+
+The PKCS12 keystore was generated with:
+
+```sh
+keytool -genkeypair -keystore ~/.internaluploader/release.p12 -storetype PKCS12 \
+  -alias internaluploader -keyalg RSA -keysize 4096 -validity 10000
+```
+
+The keystore never enters the repo. If `signing.properties` is missing, the
+release build is unsigned (fine for compile checks, not for F-Droid). Keep the
+keystore backed up: F-Droid clients pin the app signature, so a lost key means
+uninstall/reinstall on every device.
+
+## Publishing to the private F-Droid repo
+
+```sh
+thelab-kubernetes-pulumi/scripts/fdroid/publish.py add app/build/outputs/apk/release/app-release.apk
+```
+
+Bump `versionCode`/`versionName` in `app/build.gradle.kts` for every published
+build — F-Droid only offers updates on a higher `versionCode`.