Support requesting VFS hydration; fix Android TLS cross-compilation

Correcting the previous commit: I claimed VFS placeholders could not be
downloaded. That was wrong. The desktop client exposes a socket at
$XDG_RUNTIME_DIR/Nextcloud/socket speaking newline-delimited
COMMAND:argument, and MAKE_AVAILABLE_LOCALLY:<path> does fetch the file.
Verified against client 4.0.7: a 1-byte stub became a real 2.8MB file in
2.8 seconds.

Implemented as dr-sync-nextcloud::desktop_client, deliberately optional.
Android has no desktop client, no XDG_RUNTIME_DIR socket and no
placeholders, so detect() returns None there and callers fall back to the
connector. It earns its place only because it is ~30 lines with no
dependencies: where a library already lives in a VFS folder, asking the
client to fetch beats downloading a second copy over WebDAV and leaving
the client's placeholder state inconsistent.

What this does not change: hydration is whole-file, so it suits the
original tier and never browsing. Filling a grid this way downloads the
entire library. Range extraction remains the only mechanism satisfying
FR-NC-3, and ARCH §9.0 now says so precisely.

Also fixes two real Android build failures found by cross-compiling:

  - reqwest's `rustls` feature defaults to aws-lc-rs, whose aws-lc-sys
    crate is C and fails under the NDK — exactly the pain D1 chose Rust
    to avoid. Switched to rustls-no-provider + ring, installing the
    provider in the constructor so no caller can build a client that
    panics on first use.
  - ring itself needs CC/AR per target; cargo-ndk sets only the linker.
    Added them to the container.

87 tests passing. dr-sync-nextcloud cross-compiles for aarch64-linux-android.

Cargo.toml

@@ -41,11 +41,16 @@ pollster = "0.4"
 
 # Networking — no mature Nextcloud crate exists; the connector is hand-rolled
 # over reqwest (D7). reqwest_dav was evaluated and is too thin to build on.
-# `rustls` (not `rustls-tls` — renamed in 0.13) pulls in
-# rustls-platform-verifier, which crashes on Android unless initialised from
-# Kotlin. That is spike S3, and D7 records `tls_certs_only` + webpki-roots as
-# the escape hatch.
-reqwest = { version = "0.13", default-features = false, features = ["rustls", "stream", "json"] }
+# `rustls-no-provider` rather than `rustls`: the latter defaults to the
+# aws-lc-rs crypto provider, whose aws-lc-sys crate is C and fails to
+# cross-compile for Android — precisely the NDK pain D1 chose Rust to avoid.
+# ring is pure Rust apart from a small asm core that does build under the NDK.
+#
+# Note this still pulls rustls-platform-verifier, which crashes on Android
+# unless initialised from Kotlin (spike S3). D7 records `tls_certs_only` plus
+# webpki-roots as the escape hatch.
+reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "stream", "json"] }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 quick-xml = "0.41"
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "time"] }
 url = "2.5"