Backend, sync, infra, docs: ETag, API versioning, k8s, web scaffold, Android 16, domain stubs

- Backend: ShallowEtagHeaderFilter for /api/v1/*, API-VERSIONING.md, README (tenant, CORS, Flyway, ETag)
- k8s: backend-deployment.yaml (Deployment, Service, Secret/ConfigMap)
- Web: scaffold with directory pull, 304 handling, touch-friendly UI
- Android 16: ANDROID-16-TARGET.md; BuildConfig STUN/signaling, SMOAApplication configures InfrastructureManager
- Domain: CertificateManager revocation stub, ReportService signReports, ZeroTrust/ThreatDetection minimal docs
- TODO.md and IMPLEMENTATION_STATUS.md updated; communications README for endpoint config

Co-authored-by: Cursor <cursoragent@cursor.com>

modules/communications/README.md

@@ -0,0 +1,14 @@
+# Communications module
+
+WebRTC-based communications (voice, video, signaling) with infrastructure failover.
+
+## Configurable endpoints
+
+**InfrastructureManager** manages STUN, TURN, and signaling URLs. The **app** configures them at startup from BuildConfig (when set):
+
+- **STUN:** `smoa.stun.urls` – comma-separated (e.g. `stun:stun.l.google.com:19302,stun:stun.example.com:3478`). Passed as `-Psmoa.stun.urls=...` when building the app.
+- **Signaling:** `smoa.signaling.urls` – comma-separated signaling server URLs for failover. Passed as `-Psmoa.signaling.urls=...`.
+
+TURN servers (with optional credentials) are set programmatically via `InfrastructureManager.setTurnEndpoints(List<TurnServer>)` where needed.
+
+See **SMOAApplication.configureInfrastructure()** and **app/build.gradle.kts** (BuildConfig fields `SMOA_STUN_URLS`, `SMOA_SIGNALING_URLS`).