Replace BLE encryption with HMAC-only auth, add buildnr, fix post-flash flow

BLE bonding/encryption removed — HMAC-SHA256 on application level provides
authentication + replay protection. Eliminates bonding state bugs, write
queue issues, and GATT_INSUFFICIENT_AUTHENTICATION complexity.

Firmware:
- Remove BLESecurity, setRespEncryptionKey, ESP_GATT_PERM_WRITE_ENCRYPTED
- Characteristic permission: ESP_GATT_PERM_WRITE (no encryption required)
- Characteristic property: PROPERTY_WRITE_NR (Write Without Response)
  Enables direct ON/OFF sequences without ACK wait time

Android:
- Remove bondReceiver, createBond, bonding state handling
- Remove write queue / pendingRelayState / writeInProgress
- Use WRITE_TYPE_NO_RESPONSE for minimal latency
- Post-flash dialog auto-dismisses on USB detach (currentAction = NONE)
- Separate progressDialog (flash progress) from dialog (post-flash info)
- Detach during active action now calls cleanupAction()

Build number:
- BuildConfig.BUILD_NUMBER in build.gradle as yyyyMMddHHmmss timestamp
- buildFeatures.buildConfig enabled
- Displayed in SettingsActivity bottom (12sp, secondary color)

Gradle:
- Wrapper upgraded 8.5 → 8.14
- minSdk 24 → 26 (Android 8+)

README updated to reflect HMAC-only security model.

tools/copy_firmware.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -e
+
+BINARY_DIR="$(cd "$(dirname "$0")/.." && pwd)/.pio/build/m5stack-atoms3r"
+ASSETS_DIR="$(cd "$(dirname "$0")/.." && pwd)/android/app/src/main/assets/firmware"
+
+mkdir -p "$ASSETS_DIR"
+
+cp "$BINARY_DIR/bootloader.bin" "$ASSETS_DIR/"
+cp "$BINARY_DIR/partitions.bin" "$ASSETS_DIR/"
+cp "$BINARY_DIR/firmware.bin" "$ASSETS_DIR/"
+
+BOOT_APP0=$(find ~/.platformio/packages/framework-arduinoespressif32 -name "boot_app0.bin" 2>/dev/null | head -1)
+if [ -n "$BOOT_APP0" ]; then
+    cp "$BOOT_APP0" "$ASSETS_DIR/"
+else
+    echo "ERROR: boot_app0.bin not found"
+    exit 1
+fi
+
+echo "Firmware binaries copied to $ASSETS_DIR:"
+ls -la "$ASSETS_DIR"