chore(scaffold): M0 Gradle + Compose + Hilt skeleton with CI

Stand up the Android-app repo per docs/android/PLAN.md M0: a buildable
Kotlin + Jetpack Compose (Material 3) single-activity skeleton wired for
Hilt, ready for the M1-M4 functional pass.

- Gradle 8.7 wrapper; AGP 8.6.1 / Kotlin 2.0.20, JDK 17, minSdk 29, target 35.
- Version catalog (gradle/libs.versions.toml) pins the full planned stack
  (Compose, Hilt, Retrofit/OkHttp + kotlinx.serialization, DataStore,
  security-crypto, Coil, Navigation) so later milestones reference by alias.
- RunicGatewayApp (@HiltAndroidApp) + MainActivity (Compose) + ui/theme/*.
- Strings externalized from day one; adaptive launcher icon; backup rules
  exclude the token store / DataStore (no session material off-device).
- CI: .gitea/workflows/pr-checks.yml gates PRs with lint + test + assembleDebug
  (JDK 17 + Android SDK on the self-hosted runner; debug builds auto-signed,
  no secrets). Placeholder JVM unit test so the test gate runs.
- .gitattributes forces LF on gradlew so the wrapper runs on the Linux runner.

Verified locally: `gradle help`/`projects` configure the :app module and
resolve all six plugins cleanly (full assemble needs the Android SDK, done in CI).

app id: com.runicgateway.app (PLAN.md §13, pending runicgateway.app domain).

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/workflows/pr-checks.yml

@@ -0,0 +1,58 @@
+# Gate every pull request into `main` on lint + unit tests + a debug build, so a
+# broken build can't reach the deployable branch. Debug builds are auto-signed,
+# so this gate needs no secrets. The signed *release* APK + Gitea release come
+# later (release.yml, M6). See docs/android/PLAN.md §12.
+#
+# Enforcement (one-time, in the Gitea UI):
+#   Repository Settings -> Branches -> Branch Protection (rule for `main`)
+#     * Enable Status Check
+#     * Status check patterns:  PR Checks / *
+#
+# Runner: the org's self-hosted `ubuntu-latest`, on a bare `ubuntu:latest`
+# container that lacks git/curl/unzip (needed by checkout + sdkmanager) -- so the
+# first step installs them. (Faster later: switch to a prebuilt Android-SDK
+# container image so nothing installs per-run.)
+
+name: PR Checks
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: pr-checks-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  android-build:
+    runs-on: ubuntu-latest
+    steps:
+      # Bare ubuntu:latest is missing the tools checkout + the SDK installer need.
+      - name: Install base tools
+        run: |
+          apt-get update
+          apt-get install -y git curl unzip
+
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+
+      - name: Cache Gradle
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
+      - name: Lint, test, assemble debug
+        run: ./gradlew --no-daemon lint test assembleDebug