Give DodoSSH a phone, and a shared shell for both heads to drive

The Android head from docs/android-port.md, taken as far as its step 6.

Step 3, the spike, is answered and its throwaway screen is gone: libsodium.so and
libe_sqlite3.so are both in the arm64 APK, so NSec resolves its native half on Android
despite shipping no Android build, and the local cache opens. Two findings the audit
could not have had: Avalonia.Controls.WebView only ships net10.0-android36.0, which
settles the open "which Android versions" question at targetSdk 36; and Android has
blocked cleartext HTTP since API 28, so the terminal renderer needs a network security
config scoped to 127.0.0.1 or the WebView loads nothing.

DodoSSH.Client.Shell is new and is why the phone can exist: the view models, the terminal
renderer files and the palette moved there so both heads drive one state machine and draw
from one set of tokens. The desktop head is otherwise untouched and its 144 tests still
pass.

The platform pieces behind interfaces that already existed: the profile directory from
filesDir, a device key wrapped by a StrongBox-backed key that a fingerprint releases, and
a foreground service so a shell outliving a vault lock stays true on a platform that
stops backgrounded processes.

Sign-in is deliberately absent rather than approximated. It needs an app link, because
reusing the desktop loopback listener is the attack RFC 8252 section 8.3 names.

src/DodoSSH.Client.Android/DodoSSH.Client.Android.csproj

@@ -0,0 +1,54 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0-android</TargetFramework>
+    <OutputType>Exe</OutputType>
+    <Nullable>enable</Nullable>
+    <AvaloniaUseCompiledBindingsByDefault>true</AvaloniaUseCompiledBindingsByDefault>
+
+    <!--
+      minSdk 28 (Android 9), targetSdk 36. Chosen rather than inherited, because docs/android-port.md
+      flagged it as a real decision: the packages constrain targetSdk, not the floor.
+
+      28 is where the three platform APIs this head actually depends on all exist in the framework
+      itself rather than behind an AndroidX shim: BiometricPrompt, StrongBox-backed keys, and
+      KeyGenParameterSpec.SetUnlockedDeviceRequired. Going lower would mean carrying androidx.biometric
+      to reach devices that mostly cannot hold a hardware-backed key anyway — which is the one thing
+      the device key store is for.
+    -->
+    <SupportedOSPlatformVersion>28</SupportedOSPlatformVersion>
+    <TargetPlatformVersion>36</TargetPlatformVersion>
+
+    <ApplicationId>dev.dodotech.dodossh</ApplicationId>
+    <ApplicationVersion>1</ApplicationVersion>
+    <ApplicationDisplayVersion>0.1.0</ApplicationDisplayVersion>
+
+    <!--
+      False here for the same reason the desktop head sets it false: this process formats timestamps
+      and host names for a person. See DodoSSH.Client.App.csproj.
+    -->
+    <InvariantGlobalization>false</InvariantGlobalization>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Avalonia" />
+    <PackageReference Include="Avalonia.Android" />
+    <PackageReference Include="Avalonia.Themes.Fluent" />
+    <PackageReference Include="Avalonia.Fonts.Inter" />
+    <PackageReference Include="Avalonia.Controls.WebView" />
+    <PackageReference Include="CommunityToolkit.Mvvm" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <!--
+      The same view models the desktop head drives. That sharing is the whole reason this head is a
+      sibling project rather than a fork: docs/android-port.md's phone-first decision says the interface
+      is a redesign, and that what survives it is every view model, command and piece of state.
+    -->
+    <ProjectReference Include="../DodoSSH.Client.Shell/DodoSSH.Client.Shell.csproj" />
+    <ProjectReference Include="../DodoSSH.Client.Session/DodoSSH.Client.Session.csproj" />
+    <ProjectReference Include="../DodoSSH.Client.Ssh/DodoSSH.Client.Ssh.csproj" />
+    <ProjectReference Include="../DodoSSH.Client.Terminal/DodoSSH.Client.Terminal.csproj" />
+  </ItemGroup>
+
+</Project>