Initial workspace: GPU context, compute pass, adaptive Slint shell

Establishes the v0.1 foundations on both platforms:

- dr-types: SourceRef (never a filesystem path — Android SAF has none),
  Format, Availability, Validator with ETag quote normalisation
- dr-gpu: wgpu device, compute pass writing a storage texture, resize
- dr-ui: Slint shell with FR-UI-1 adaptive layout, computed in Rust to
  avoid a binding loop
- docker/android: pinned toolchain, verified producing API 28 ARM binaries

Measured the cost of the temporary CPU readback path (dr-gpu bench):
compute is 0.06-0.28ms across sizes while readback is 0.63-7.43ms, so
readback is 90-96% of frame time and scales with area. Recorded in
ARCH §6.1 — this is why spike S1 is the priority.

Mitigations pending S1: reuse the staging buffer, apply at most one
resize per frame, and cap render resolution at 2048 on the long edge.

10 tests passing; core crates cross-compile for aarch64-linux-android.

ui/dr-ui/ui/theme.slint

@@ -0,0 +1,29 @@
+// Darkroom safelight palette. Warm neutrals, single red accent.
+// Committed to a dark ground — this is a photo editor, and a light UI
+// surrounding an image biases how that image is judged.
+
+export global Theme {
+    out property <color> ground: #14120F;
+    out property <color> surface: #1D1A16;
+    out property <color> surface-raised: #262119;
+    out property <color> rule: #332C24;
+
+    out property <color> ink: #F0EAE0;
+    out property <color> ink-dim: #A79E91;
+    out property <color> ink-faint: #7C7367;
+
+    out property <color> accent: #D9543C;
+    out property <color> accent-dim: #8F2E1E;
+
+    out property <length> gap-sm: 6px;
+    out property <length> gap: 12px;
+    out property <length> gap-lg: 20px;
+
+    out property <length> text-sm: 11px;
+    out property <length> text: 13px;
+    out property <length> text-lg: 17px;
+    out property <length> text-xl: 24px;
+
+    // FR-UI-3: minimum 44pt hit target under touch.
+    out property <length> touch-target: 44px;
+}