Reproducible build, signed APK

Release 1.2.3 (versionCode 6): pin JDK 21 toolchain

The app module inherited whichever JDK was on PATH, so bytecode
depended on the build host. Pin jvmToolchain(21) to match the engine
module and make F-Droid's reproducible-build check deterministic.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Initial public release (debug build)

Bump AGP to 8.7.3 and Gradle to 8.9 for compileSdk 35 support

Gradle plugin was only tested up to compileSdk 34, causing a build warning.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>