v0.5.0 — Waze police source via key-protected proxy

Re-adds the WAZE detection source (removed in v0.1.5 when Waze reCAPTCHA-gated
its live-map endpoint). Data comes from OpenWeb Ninja's hosted Waze feed, but
the paid API key never ships in the app: a Caddy reverse proxy at
api.blackflagintel.com injects the key server-side, and the app authenticates
with a scoped X-App-Token entered in Settings and stored encrypted via the
Android Keystore (SecureStore). No credential is baked into the APK.

- scan/WazeClient.kt, scan/WazeScanner.kt: proxy client + 4-min poller,
  200-alert page + client-side POLICE filter, 45-min freshness window.
- data/settings/SecureStore.kt: Keystore AES/GCM at-rest store (no dependency).
- Settings: encrypted wazeProxyToken + "Waze police feed" token field.
- ConfidenceEngine.scoreWaze, SourceHealth/DetectionSource WAZE, service wiring.
- Removes the BuildConfig/local.properties key baking entirely.

versionCode 15 -> 16, versionName 0.4.0 -> 0.5.0.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015jgJnzMr2bdNuWcDX2xRUR

local.properties.example

@@ -14,3 +14,8 @@ sdk.dir=/Users/YOUR_USERNAME/Library/Android/sdk
 #       in your shell profile
 #   (b) put the line below into ~/.gradle/gradle.properties (NOT project gradle.properties):
 #       org.gradle.java.home=/usr/local/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home
+
+# The Waze police source no longer uses an app-side key. The OpenWeb Ninja key
+# lives only on the api.blackflagintel.com proxy (server-side); the app calls
+# that proxy with a token pasted into Settings (stored encrypted on-device).
+# Nothing to configure here for Waze.