Android: public host as the build property kvitt.publicHost (D-121)

The release server's host name comes from -Pkvitt.publicHost, else kvitt.publicHost in
android/local.properties, else the placeholder kvitt.example.invalid. :app exposes it as
BuildConfig.PUBLIC_HOST, the manifest placeholder publicHost (the https invite-link intent
filter, port 8443) and RELEASE_SERVER_URL, which :feature:onboarding receives through the
@ReleaseServerUrl Hilt qualifier for S-1's prefill. Tests and goldens use fixed hosts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

android/README.md

@@ -5,6 +5,14 @@ One Gradle project, modules as in SPEC §6.2 and §14.7. Build only through `too
 compile, unit tests (including every vector of `contracts/test-vectors/`), lint (`MissingTranslation` and
 `ExtraTranslation` are errors), the architecture check and the screenshot tests.
 
+**Public host (D-121).** The release server's host name is the build property `kvitt.publicHost`, never a literal in
+the code: `:app` exposes it as `BuildConfig.PUBLIC_HOST`, as the manifest placeholder `publicHost` (the host of the
+`https://<host>:8443/i/<CODE>` invite links, AC-2.6) and as `RELEASE_SERVER_URL` = `https://<host>:8443`, which S-1
+prefills (AC-2.7). Gradle takes `-Pkvitt.publicHost=…` first (`infra/publish-apk.sh` passes it), else the key
+`kvitt.publicHost` in `android/local.properties`, where the owner sets it (git-ignored, never committed), else the
+placeholder `kvitt.example.invalid`, so a release built without it cannot talk to a real host. Debug builds pair with
+the address typed on S-1. Tests and goldens never depend on it: they use fixed hosts.
+
 ## Modules
 
 | Module | Plugin (build-logic) | Notes |