Write down what the phone found, and stop it rotting

docs/android-port.md was an audit of work not started; it now says what is built. Three of
its statements needed correcting rather than extending, and they are marked where they sit:
the Android version question is settled and was never as open as it looked, because
Avalonia.Controls.WebView ships only a net10.0-android36.0 assembly and nothing lower can
resolve it; cleartext to loopback has to be permitted explicitly, which the audit missed
entirely; and the spike produced a structural change it did not anticipate, in
DodoSSH.Client.Shell.

A CI job of its own, because the head is deliberately not in DodoSSH.slnx and a project
outside the solution is a project nobody notices breaking. It packages as well as builds:
a native library with no Android ABI and an assembly that will not dex are both invisible
to a compile, and both are exactly what this head is exposed to.

The README says plainly that signing in is not built, that a fingerprint re-enrolment
destroys the device key, that a notification appears while a shell is open, and that none
of it has run on a device.

src/DodoSSH.Client.Android/Views/LockedScreen.axaml

@@ -49,7 +49,7 @@
           the nearest thing to hand, and reaching past it to a button is the sort of friction that gets a
           phone client called slow.
         -->
-        <TextBox Text="{Binding Passphrase}" PasswordChar="•" Watermark="vault passphrase"
+        <TextBox Text="{Binding Passphrase}" PasswordChar="•" PlaceholderText="vault passphrase"
                  Height="48" Padding="14,0" VerticalContentAlignment="Center"
                  Background="{StaticResource Field}" BorderBrush="{StaticResource BorderMid}"
                  BorderThickness="1" CornerRadius="6" Foreground="{StaticResource Text}"