Feat: Build reliable AndroidAPM server foundation - #1

Summary

• establish the versioned Android SDK to Collector contract, security model, architecture ADRs, SigNoz boundary, deployment plan, and canonical cloud backlog
• add an authenticated FastAPI Gateway for bounded Gzip, Line Protocol, and length-prefixed Protobuf ingestion
• durably deduplicate whole batches in PostgreSQL with tenant isolation, transactional quotas, conflict detection, and commit-before-ACK semantics
• add leased Inbox export workers, OTLP Logs mapping, retries, dead-letter handling, Prometheus diagnostics, and SigNoz dashboard/alert asset synchronization
• add Ed25519-signed remote configuration with stable rollout, immutable revisions, ETag handling, audit records, and administration commands
• add Alembic migrations, locked uv dependencies, hardened container assets, Compose services, PostgreSQL concurrency tests, and GitHub CI

Verification

• uv sync --all-groups --frozen
• uv run ruff check .
• uv run mypy src
• uv run pytest (44 passed)
• uv run pytest --cov=androidapm_server --cov-report=term --cov-fail-under=70 (71.76%)
• uv run python scripts/verify_docs.py
• SQLite Alembic upgrade -> downgrade -> upgrade and admin-key creation smoke test
• git diff --check

Still intentionally pending

• live Docker/PostgreSQL/SigNoz staging verification; the CI workflow is the first available PostgreSQL and container execution environment
• Java mapping and Native symbol artifact upload/indexing plus retrace/llvm-symbolizer workers
• Android SDK dynamic authentication and signed remote-config polling/cache integration
• production TLS/WAF, RLS, backup/PITR, retention, fault injection, load tests, and deployment evidence

This PR is intentionally draft: it is the first runnable server foundation, not a claim that the entire hosted APM product is production-ready.