Hermes Android v3.2.4-rc.2 - Upcoming crons, Projects root, API-only refusals

Testing release candidate — please install over 3.2.4-rc.1 or 3.2.3 and report back.

Base build 3031; splits 30311 / 30312 / 30313, each above the highest 3.2.4-rc.1 split (30303), so this upgrades in place. The latest published stable remains 3.2.3; this is a prerelease and not a stable promotion.

Independent of 3.2.4-rc.1, which carried only test coverage for #253. Everything below is new on top of it.

What to test

Crons → Upcoming (#259)
Crons now opens on Upcoming, listing scheduled jobs read from the cron manager, so a job scheduled for next week is visible before it has ever run. History keeps the previous run browser. Next-run times always state their zone — the payload supplies numeric offsets, not named zones, so you'll see e.g. Next: 2026-11-09 09:00 (UTC+11:00), and where the schedule carries no zone at all it says so rather than assuming your phone's zone.
Please check: a freshly scheduled future job appears immediately; a finished one-off doesn't hide future jobs; creating/deleting in the manager updates Upcoming on return; an API-only connection says it needs a Dashboard instead of showing an empty list.

Configurable server-side Projects root (#232)
More → Projects folder on the server sets where the app creates Projects, per saved connection. Projects → Add an existing folder lists folders already on the server and adopts one as a Project. Default behaviour is unchanged until you use it, and a dashboard locked_root still wins and shows read-only.
Please check: projects created from the TUI under your own path become visible; a new app Project lands where you chose. Note it does not move Projects that already exist, and listing covers direct non-hidden children only.

API-only send refusals (#253)
On a connection with only an API-server key, sending into a Dashboard-owned chat is refused by the gateway. The notice now says what to check while keeping the server's exact wording, phrased conditionally — adding Dashboard credentials may help, and the server may be refusing deliberately. Send routing, principal and retry behaviour are unchanged.

Lighter background refresh (#149)
The visible chat-list refresh no longer re-reads the archived list every ten seconds while a non-archived filter is selected. In fixtures over three ticks, archive requests drop 8 → 2 on Chats and 10 → 4 on Crons. Selecting Archived fetches immediately; pull-to-refresh is unchanged.
Please check: Archived still lists correctly and updates when selected; nothing disappears from Chats during normal use.

Also: a Buy Me a Coffee link now sits at the top of the README (#263) — optional, and it gates nothing.

Verification performed

• Integrated tree: flutter analyze --fatal-infos clean; 5,548 tests passed, zero failures, zero skipped.
• Published APKs downloaded and re-verified: package com.hermesagent.hermes_android, versionName 3.2.4-rc.2, split codes 30311/30312/30313, matching ABIs, production signer 475baf43…f592fb, hashes matching SHA256SUMS and the release asset digests.
• scripts/verify_release_apks.py run from a checkout at the publication commit: exit 0, 22 packaged-blob checks per APK.
• Source bundle manifest names commit f4906eb2 and all three APK hashes; inner archive digest matches.

Not verified

No on-device or emulator acceptance. No live multi-timezone server, no multi-root server, and no real gateway authorisation reproduction. Timezone rendering, Projects-root behaviour and the permission-denied notice need confirming on real hardware before any stable promotion or F-Droid update.

Full notes: docs/releases/3.2.4-rc.2.md · CHANGELOG