v0.14.0 remaining: Play Store unblock + ChromeWatcher crash fix

Follow-up to #176. Context rebuilt from full thread read.

## Current state (as of 2026-07-12)

- **v0.14.0dev20260712**: GitHub release published ✅, Play Store upload **blocked** (see item 1 below)
- **Top crash driver**: ChromeWatcher NPE (item 2) — dominant crash cluster, ~791 reports
- All SDK/build/fastlane blockers from #176 are resolved

## Open items

### 1. Remove `FOREGROUND_SERVICE_DATA_SYNC` permission (Play Store release blocker)

The v0.14.0 fastlane upload fails with:
```
Google Api Error: Invalid request - You must let us know whether your app uses any Foreground Service permissions.
```

Google Play Console requires a declaration form + demo video for `FOREGROUND_SERVICE_DATA_SYNC`. Since sync is disabled by default (#184) and not demo-able, we should remove it for now.

**Fix**: Two-line removal from `AndroidManifest.xml`:
- ``
- `android:foregroundServiceType="dataSync"` from the `SyncAlarmReceiver` service entry (or just drop the `uses-permission` and leave the type — the type without the permission is inert)

Re-add when sync is actually shippable and a demo video can be recorded.

### 2. ChromeWatcher NPE (top crash cluster — ~791 reports)

From `vitals.py errors`:
- **#1**: 791 reports — `NullPointerException` in `ChromeWatcher.onAccessibilityEvent` at **ChromeWatcher.kt:76**
- **#2**: 26 reports — `NotImplementedError` in `ChromeWatcher.onInterrupt` (not implemented)

This is the dominant driver of the ~8% user-perceived crash rate. Needs a null-check guard at ChromeWatcher.kt:76 and a stub `onInterrupt` implementation.

### 3. Hostname validation in aw-server-rust (enhancement, not blocker)

Erik requested a server-side guard to reject bucket creation with space-containing hostnames (so a misconfigured Android client can't create a broken bucket). Fix location: aw-server-rust bucket creation path.

### 4. Native OOM in sync (tracked upstream)

The `Scudo ERROR: Out of memory` crash during `syncBoth` is tracked in ActivityWatch/aw-server-rust#630 (unbounded event fetch). Short-term mitigation already merged (#184 — disabled auto-sync by default). Long-term fix is batch/stream processing in aw-server-rust.

## Done in #176

- targetSdkVersion 34→35 (#179 ✅)
- Build.DEVICE hostname fallback in both RustInterface.kt and SyncInterface.kt (#183 ✅)
- Auto-sync disabled by default (#184 ✅)
- Pre-release version workflow (#178 ✅)
- SUPPLY_TRACK routing fix for Play Store (#182 ✅)
- aw-webui Android device detection runtime fix (aw-webui#903 ✅)
- RubyGems/fastlane fix (#180 ✅)
- Hallucinated 'Related issues' section removed from #176 body

## Priority order

1. **#1 (FOREGROUND_SERVICE_DATA_SYNC removal)** — unblocks the v0.14.0 production Play Store upload; 2-line change
2. **#2 (ChromeWatcher NPE)** — dominant crash cluster, directly driving the rating decline
3. **#4 (upstream OOM)** — mitigated already, long-term fix in aw-server-rust#630
4. **#3 (hostname validation)** — enhancement, doesn't block release