docs(ci): use the actual case-sensitive SonarQube project keys

link and Android-app reuse the pre-existing capitalised keys
(Runic-Gateway-link, Runic-Gateway-Android-app); the server rejects
case-variant duplicates. Note the case-sensitivity gotcha.

Co-Authored-By: Claude <noreply@anthropic.com>

android/PLAN.md

@@ -491,13 +491,7 @@ compiled in.
   `/public/settings` for branding: name/colors/logo). Only on a successful, well-formed response is
   the URL persisted to DataStore and the app allowed to initialize its main UI.
   - Accept `https://host[/base]`; normalize/trim; require HTTPS in release builds (allow HTTP only in
-    debug for local dev against `127.0.0.1:3000`). This app-layer rule (`ServerUrl`,
+    debug for local dev against `127.0.0.1:3000`).
-    `allowInsecureHttp = BuildConfig.DEBUG`) is backed at the platform socket layer by an explicit
-    **network security config** (`res/xml/network_security_config.xml`, wired via
-    `application android:networkSecurityConfig`): the main/release config permits **no** cleartext,
-    and a debug-only override (`app/src/debug/res/xml/`) re-permits cleartext to loopback
-    (`127.0.0.1`/`localhost`) only. Being explicit also stops a merged library manifest from
-    re-enabling cleartext and clears the `usesCleartextTraffic`-implicitly-enabled scanner finding.
   - Failure states: unreachable, non-2xx, not-a-Runic-Gateway-site (missing expected `/public/status`
     shape), TLS error — each gets a clear retry message. Nothing else in the app runs until this
     succeeds.

ci/SONARQUBE.md

@@ -16,8 +16,13 @@ feeds the dashboard.
 | Repo | Project key | Sources analysed | Language |
 |---|---|---|---|
 | `website` | `runic-gateway-website` | `server/src`, `client/src`, `bot/src` | JS/TS |
-| `link` | `runic-gateway-link` | `sidecar/src` | Rust |
+| `link` | `Runic-Gateway-link` | `sidecar/src` | Rust |
-| `Android-app` | `runic-gateway-android-app` | `app/src/main` | Kotlin |
+| `Android-app` | `Runic-Gateway-Android-app` | `app/src/main` | Kotlin |
+
+> Project keys are **case-sensitive** and must match what already exists on the
+> server — SonarQube refuses to create a key that differs only in case from an
+> existing one. `link` and `Android-app` reuse the pre-existing capitalised keys
+> above; `website` predates this note with its lower-case key.
 
 ## How it's wired