Unprivileged containers can't create TUN devices, so use SOCKS5
proxy mode instead. SSH routes through the proxy via ProxyCommand.

- Connect to headscale tailnet for secure upload
- Build APKs then rsync to coord staging directory
- Nightly fdroid-update service promotes yesterday's build

- Enable R8 minification and resource shrinking for release builds
- Add ABI splits to produce per-architecture APKs
- Add ProGuard keep rules for JNA and UniFFI (required for native bindings)
- Gitignore jniLibs build artifacts

- Add android-toolchain flake package for CI builds
- Add Spindle workflow for Android release builds
- Configure Gradle release signing from environment variables
- Update SDK to 36, deduplicate flake devShell
- Gitignore keystore files

- Add binary wire format for location data (~60% smaller than JSON)
- i32 microdegrees for lat/long (~11cm precision)
- i16 meters for altitude (±32km range)
- u16 meters for accuracy
- u64 milliseconds for timestamp
- Add altitude field throughout the stack (Rust core, iOS, Android)
- Create Protocol documentation page with wire format specification
- Update self-hosting docs with deployment guidance
- Add download modal with TestFlight link

Privacy-preserving location sharing with end-to-end encryption.

- Rust core library with X25519/Ed25519 crypto and AES-256-GCM encryption
- Native iOS app (SwiftUI)
- Native Android app (Jetpack Compose)
- Relay server (Axum)
- Astro documentation website

The server is an untrusted relay that stores only encrypted blobs it cannot
decrypt. All cryptographic operations happen client-side.