v9: private-repo-ready + persistent launcher + remote commands

TRANSITIONAL RELEASE -- last public release. Once your devices have all auto-updated to v9 you can flip the repo private; v9+ APKs send Authorization: Bearer with a baked-in PAT. New: persistent launcher pinning via DevicePolicyManager (no more 'Choose a Home app' prompt on reboot). Remote management: HA automations can fire 'kiosk_command' events with {device, command, value} to disable_siren / enable_siren / set_url / reload / restart any kiosk by display name (or 'all').