Use target-safe capture defaults and remove redundant navigation and
frame-rate controls.

Preserve decoder timing and keep blocking speaker writes off codec
callbacks. Playback failures no longer take down video or control.

The form asked for a host, a pairing port and a connection port as three
separate fields. Nothing on screen says which port is which, and the two
are only distinguishable if the reader already knows how adb pair works
on Android 11+.

Take the connection endpoint the way the target prints it, as a single
"ip:port" string copied off the Wireless debugging screen, and leave the
pairing dialog with just its port and code. Devices.parseAddress() does
the split and rejects anything malformed rather than guessing: an
unbracketed IPv6 literal would otherwise be split at the wrong colon.

Reported on the F-Droid submission (fdroiddata!41394).

targetSdk 35 makes every window edge-to-edge on Android 15. Neither
activity handled insets, so Main drew its header under the status bar
and the Settings ScrollView started at window y=0: the framework action
bar covered its first 80dp and the navigation bar covered the last rows.

Pad both roots by the system bar insets. Main adds the IME inset as
well, since an edge-to-edge window is not resized when the keyboard
opens. Settings drops the framework action bar and draws its own title
like Main already does, which removes the action-bar-versus-inset
interaction entirely.

Reported on the F-Droid submission (fdroiddata!41394).

Migrate hosting from Codeberg to GitLab. Update the LGPL
source-availability notices in THIRD_PARTY_NOTICES to
gitlab.com/0xlena/scrcpy-android.

Pin and verify what goes into a release: JitPack confined to the
SPAKE2 module via exclusiveContent, the vendored subtree pulled by
commit SHA instead of a mutable tag, a pinned Docker base digest with
a checksummed cmdline-tools download, and a verifyScrcpyServer task
wired into every assets merge. The expected server checksum can be
overridden with -PscrcpyServerSha256 when the jar is built from
source.

build-apk now requires apksigner and fails unless independent
signature verification succeeds. Split the test image into unit and
e2e targets so JVM-only test runs do not download an emulator. Ship
THIRD_PARTY_NOTICES and the LGPL text for SPAKE2 in the APK. Add
scripts/check as the host quality gate.