Add Android TWA build config and Digital Asset Links (#203)

The Android app is a Trusted Web Activity — a thin native shell that opens the
live PWA full-screen in the user's Chrome engine, so it is literally the web app
and the existing VAPID web push keeps working inside it via Android notification
delegation (no Firebase, no backend change).

Adds the build config and the domain-verification file so the app can be built
and sideloaded:

- deploy/twa/twa-manifest.json — Bubblewrap config; packageId org.thermograph.twa,
  enableNotifications true (web-push delegation + Android 13 POST_NOTIFICATIONS),
  colors/icons from manifest.webmanifest.
- frontend/.well-known/assetlinks.json — Digital Asset Links, served at the domain
  root as application/json (verified via the static mount). The signing-key
  fingerprint is a placeholder until the keystore is generated.
- deploy/twa/README.md — build/sideload/verify runbook.

Building the signed APK, generating the keystore, filling the fingerprint, and
sideloading are local manual steps (documented). Play Store submission is deferred.
No backend/ changes.

Claude-Session: https://claude.ai/code/session_013dRZmX9D3JEntfMKWMTWZ8

static/.well-known/assetlinks.json

@@ -0,0 +1,12 @@
+[
+  {
+    "relation": ["delegate_permission/common.handle_all_urls"],
+    "target": {
+      "namespace": "android_app",
+      "package_name": "org.thermograph.twa",
+      "sha256_cert_fingerprints": [
+        "REPLACE_WITH_TWA_SIGNING_KEY_SHA256_FINGERPRINT"
+      ]
+    }
+  }
+]