v6.8.15: the Android app is out for testing

- Android APK download, served from securebit.chat (/downloads/, never
  committed): a "Download Android APK" badge next to the Snap Store one, drawn
  for both themes, and an Android entry in the download menu (recommended on
  Android devices). nginx serves .apk as an attachment; the service worker
  leaves /downloads/ alone. The APK version is one constant in three places,
  checked by tests/desktop-download-links.test.mjs.
- Roadmap versions follow the real releases: Group Communications v6.0
  shipped, Mobile Edition v6.8 is current, Quantum-Resistant v7.0 is in
  development (2027), then v8.0 and v9.0.
- "Download desktop app" is now "Download the app"; the "You're on Web" pill
  in the download menu is gone.

sw.js

@@ -11,7 +11,7 @@ let DYNAMIC_CACHE = 'securebit-pwa-dynamic-v4.7.56';
 // Build stamp — rewritten by scripts/post-build.js on every release so this file's
 // bytes change each deploy. That is what makes the browser detect a new Service Worker,
 // reinstall it, drop stale caches and (via controllerchange) prompt the page to update.
-const SW_BUILD_VERSION = '1790548306121';
+const SW_BUILD_VERSION = '1790572497433';
 
 // Locale subdirectories, rewritten by scripts/build-i18n.js. Each localized page is a
 // separate document at its own URL, so the shell has to be cached and served per
@@ -270,6 +270,12 @@ self.addEventListener('fetch', (event) => {
         return;
     }
     
+    // Downloads (the Android APK, ~45 MB) go straight to the network: nothing to
+    // gain from streaming them through the worker, and they must never be cached.
+    if (url.pathname.startsWith('/downloads/')) {
+        return;
+    }
+
     // Skip sensitive endpoints
     if (isSensitivePath(url.pathname)) {
         console.log('🔒 Skipping cache for sensitive endpoint:', url.pathname);