Add tag autocomplete to the Android app

Both tag fields (post and edit) now suggest existing tags as you type,
matching the web upload/manage forms. Suggestions come from a new
GET /api/tags.json that serves the generated public/tags.json. It lives under
/api/ so nginx proxies it to the app, reaching non-browser clients even when a
front-door botwall gates the static site (the same approach as /api/thumb/).

/api/tags.json and /api/thumb/{slug} are both left unguarded: they serve the
same public data as the static site (/tags.json and /thumbs/), so there is
nothing to protect, and keeping them off the auth path means they can never
return 401 — otherwise an nginx auth-fail jail (fail2ban) would ban the app
over an autocomplete poll or a per-row thumbnail load.

A reusable TagField composable filters on the token after the last comma and
completes it on tap; fetchTags() returns an empty list on any failure, so the
field degrades to a plain tags input when the endpoint is absent.

android/README.md

@@ -4,6 +4,9 @@ Native uploader and manager for the photogallery server. Pick or share one or
 many photos, add caption/date/tags, and post. A **Manage** screen lists the
 published posts and edits their caption/date/tags or deletes them (to the
 server's trash) over the same `/api/*` endpoints the web `/manage` uses.
+Both tag fields autocomplete from the existing tags (fetched from
+`/api/tags.json`, unguarded public data proxied past the botwall), filtering on
+the token after the last comma.
 Credentials are entered once and sealed with a key held in the Android Keystore.
 
 The server is not modified by this app. Everything it needs, it does client