Backend, sync, infra, docs: ETag, API versioning, k8s, web scaffold, Android 16, domain stubs

- Backend: ShallowEtagHeaderFilter for /api/v1/*, API-VERSIONING.md, README (tenant, CORS, Flyway, ETag)
- k8s: backend-deployment.yaml (Deployment, Service, Secret/ConfigMap)
- Web: scaffold with directory pull, 304 handling, touch-friendly UI
- Android 16: ANDROID-16-TARGET.md; BuildConfig STUN/signaling, SMOAApplication configures InfrastructureManager
- Domain: CertificateManager revocation stub, ReportService signReports, ZeroTrust/ThreatDetection minimal docs
- TODO.md and IMPLEMENTATION_STATUS.md updated; communications README for endpoint config

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/infrastructure/k8s/backend-deployment.yaml

@@ -0,0 +1,80 @@
+# Example Kubernetes Deployment and Service for SMOA backend.
+# Apply: kubectl apply -f docs/infrastructure/k8s/
+# Requires: backend image built (e.g. docker build -f backend/Dockerfile .) and pushed to your registry.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smoa-backend
+  labels:
+    app: smoa-backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: smoa-backend
+  template:
+    metadata:
+      labels:
+        app: smoa-backend
+    spec:
+      containers:
+        - name: backend
+          image: smoa-backend:1.0.0
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+          env:
+            - name: SPRING_PROFILES_ACTIVE
+              value: "prod"
+            - name: SMOA_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: smoa-secrets
+                  key: api-key
+            - name: SMOA_CORS_ORIGINS
+              valueFrom:
+                configMapKeyRef:
+                  name: smoa-config
+                  key: cors-origins
+                  optional: true
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 5
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smoa-backend
+  labels:
+    app: smoa-backend
+spec:
+  type: ClusterIP
+  ports:
+    - port: 8080
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: smoa-backend
+---
+# Optional: create secret and configmap (replace values)
+# kubectl create secret generic smoa-secrets --from-literal=api-key=YOUR_API_KEY
+# kubectl create configmap smoa-config --from-literal=cors-origins=https://smoa.example.com