docs(android): M12 phase 0 as landed, and phase 7 cancelled

Two records, one milestone.

Phase 7 (reading nav_admin / nav_player) is cancelled. Section 6.4 already
made the case against it and scheduled it last so the call could be taken on
its merits with the rest working: the two authenticated navs reach four app
rows between them, which does not pay for a new authenticated fetch, a
session-keyed cache and its teardown. The app therefore makes no authenticated
settings call at all, and the player and staff drawer rows keep their coded --
and so localized -- labels, which is the one thing given up. Section 4's locked
decision, section 3's endpoint row and section 5.5's lifecycle paragraph are
amended to match so the doc does not contradict itself, and section 8 gains
the standing "Phase 7, cancelled" note.

Phase 0 (the contract and the appearance store) landed as Android-app#33, and
its "as landed" notes record two departures from what section 8 specified:

- `theme` is modeled as a raw JsonElement rather than Map<String,String>?.
  kotlinx fails the decode of the whole object on a value of an unexpected
  kind, and `theme` shares its payload with `brand` and `push` -- so one odd
  token would have blanked the branding and dropped the push relay URL, the
  opposite of section 2. It is coerced field-by-field instead.
- A failed refresh keeps the last good appearance rather than falling back to
  NONE. Section 5.5 said best-effort; the distinction it did not draw is that
  a moment of no connectivity on resume must not repaint a themed shard back
  to the shipped defaults.

Co-Authored-By: Claude <noreply@anthropic.com>

android/PLAN.md

@@ -1030,14 +1030,19 @@ push, and Play (M6–M8) follow the designed app.
       `nav_admin` two (`/player`, `/account`, `/admin`, `/admin/moderation`); the sidebar's other
       ~18 rows are admin *configuration* the app excludes, and two of the app's four staff entries
       are aggregates with no single web row. That is why they honor `label` and `hidden` only — and
-      why that phase is scheduled **last and marked optional**, so it can be dropped on its merits
-      once the rest is working.
+      why that phase was scheduled **last and marked optional**, so it could be dropped on its
+      merits. **It was: phase 7 is cancelled (2026-08-08).** The app makes no authenticated settings
+      call, `nav_admin` / `nav_player` are not consumed, and the player and staff drawer rows keep
+      their coded — and therefore localized — labels. Nothing in phases 0–6 was scaffolding for it.
     - **Excluded**, in the same class as M10's and M11's exclusions: the admin *configuration* panels
       themselves. The app does not gain Appearance or Navigation editors; it is a consumer.
 
-    Nine phases into a fresh `edge` in both repos, reaching `main` as one `edge` → `main` merge —
-    the same shape the website side used. Phase 0 (the contract and the appearance store) carries a
-    hard rule: it must change nothing on screen.
+    Eight phases (0–6 and 8; **7 cancelled**) into a fresh `edge` in both repos, reaching `main` as
+    one `edge` → `main` merge — the same shape the website side used. Phase 0 (the contract and the
+    appearance store) carries a hard rule: it must change nothing on screen. **Phase 0 landed
+    2026-08-08** (Android-app#33 / docs#112): `SiteAppearance` now holds the brand, the resolved
+    theme tokens and the parsed `nav_public`, refreshed on resume, with nothing yet reading the last
+    two — see THEMING_AND_NAV.md "Phase 0 as landed".
 
 ### Deferred (not a milestone)