License the project; add root README, website, and parked release CI

- Code: GPL-3.0-or-later (LICENSE, SPDX headers on all .kt/.aidl).
  Specs in docs/: CC-BY-4.0 (docs/LICENSE). Rationale in build-status.md;
  server decided GPL (not AGPL).
- Root README for the public repo.
- web/: Cloudflare Worker site for echo-lot.app. /apk resolves the newest
  APK from the Gitea latest-release API at request time (edge-cached 5 min),
  so tagging a release is the only publish step. /fdroid, /source, and a
  manual DOWNLOAD_URL fallback are wrangler vars.
- .gitea/workflows/release.yml: tag-driven (v*) signed semver APK builds for
  the future production app in echolot-app/. Parked; the prober is
  deliberately not CI-built.
- Fix UserService.kt: drop the explicit secondary constructor that
  conflicted with the implicit primary (never compiled before — first
  local build caught it). Prober now builds: :app:assembleDebug OK.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -12,7 +12,9 @@ no-root feasibility matrix on real hardware before the production app is built.
   Flutter would be a Dart skin over a full Kotlin app + F-Droid build friction).
 - **Tiers:** `app` (no root), `shizuku` (ADB-shell privileges via wireless pairing, shipped in v1),
   `root` (future module). Every result records which tier produced it.
-- **License:** undecided (GPLv3 vs Apache-2.0). LICENSE is a TODO before going public.
+- **License:** code is **GPL-3.0-or-later** (`LICENSE`), the specs in `docs/` are **CC-BY-4.0**
+  (`docs/LICENSE`). New source files get the two-line SPDX header the existing ones carry.
+  The server, when it lands, is GPL too — not AGPL (see `docs/build-status.md` for the reasoning).
 
 ## Design docs (source of truth, in `docs/`)