[mikahatdichlieb]

Closes #1

What

• Kotlin + Jetpack Compose skeleton with one placeholder screen (Gradle 9.8.2 wrapper with checksum, AGP 9.4.1, Kotlin 2.4.21, Compose BOM 2026.09.00, version catalog)
• minSdk 26, targetSdk 36, compileSdk 37 (required by the Compose libraries)
• ktlint 1.8.0, detekt 1.23.8, Android Lint with warnings as errors, one unit test
• Gradle dependency verification (SHA-256) enforced in every Gradle job
• CI: ktlint, detekt, android lint, unit tests, assembleDebug, gitleaks (pinned binary, checksum-verified, dcX_ token rule + self-test). Actions pinned to commit SHAs
• CLAUDE.md, README, scripts/gh-project.sh, LICENSE (AGPL-3.0-only)

Notes

• Touches .github/workflows/ci.yml (new).
• 9 POM/module checksums in gradle/verification-metadata.xml were added by hand from Maven Central (Gradle's write mode missed them on a cold cache).
• Lint OldTargetApi is disabled so targetSdk stays at 36 on purpose.
• No token storage, networking, privacy or wire-format code.