docs: cover the tablet screenshot slots and settle app pricing

Two Console-facing subjects, both decided here instead of in the Console.

Tablet screenshots (7-inch and 10-inch)
--------------------------------------
Play keeps a separate screenshot slot per form factor and asks for at least four
screenshots on tablets, so the four phone captures did not cover them. Both sets are now
captured on AOSP Android 12 AVDs, over the same generated 22-photo demo library, and
normalised with FORM_FACTOR=tablet-7in|tablet-10in:

- 7-inch - Nexus 7 2013: 1200x1920 portrait, sw600dp, 320 dpi, four files
- 10-inch - Medium Tablet: 1600x2560 portrait, sw800dp, 320 dpi, four files

This machine has no /dev/kvm - the node cannot even be created, because mknod is refused
for the container as root - so the emulator ran in pure software emulation (-accel off
-no-window -gpu swiftshader_indirect): about 3 minutes to boot, 1-12 s per screenshot.
hide_error_dialogs was switched on and the animation scales off, because under TCG
SystemUI raises an ANR dialog that would otherwise sit in the frame; the 10-inch profile
boots landscape and its portrait rotation is 3, not 0. The scanning frame comes from a
screencap burst started before the tap, since 22 photos scan in seconds, and the tap
coordinates come from uiautomator dumps rather than guesswork.

The results screens are not staged: a finished scan auto-selects all but best, so "14
selected, 43.7 MB" is the default state. 2 duplicate groups, 16 of 22 photos, 43.7 MB
reclaimable, scanned in 39.7 s (7-inch) and 53.1 s (10-inch). Nothing except the demo
library was ever pushed to either AVD and it is deleted again afterwards, so no real
photo can appear in the tablet sets. Screenshots stay out of git, as before.

App pricing: a one-time paid app
--------------------------------
The one irreversible decision in this release. Play's rule: an app can go paid -> free,
but "once your app has been offered for free, the app can't be changed to paid" - a new
package name would be needed - so this had to be settled before the first upload, which
has not happened yet (versionCode 2).

Chosen over free with a Pro unlock because it is the only model that costs the app
nothing: no Billing dependency, no com.android.vending.BILLING permission, no Data
Safety answers, and the "no internet permission at all" claim survives untouched.
Checked rather than assumed: unpacking com.android.billingclient:billing:9.1.0 shows its
manifest declares only com.android.vending.BILLING and the billing service queries, so
in-app purchase would not have added INTERNET either. Billing 8+ is the current
requirement (latest 9.1.0) if that is ever revisited.

Price: base EUR 2.99 with a 14-day 50% launch sale at EUR 1.49. A EUR 1 base price was
considered and rejected: a sale can always be added, but a low anchor cannot be undone,
and a paid app's first transaction is its only transaction. Play's fee for a paid app's
initial purchase is 10% + 5% billing fee (~15%) for the first $1M/year of new-install
transactions in the EEA, so EUR 2.99 nets ~EUR 2.54 against ~EUR 0.85 at EUR 1. The sale
rules shape the launch: 1-14 days live, 30 days between one sale ending and the next
starting, and the app must be published before a sale can be created. The strikethrough
does appear in Germany, which is not one of the 12 EU states and the UK that hide it.

The listing copy had to stop saying "free": the short description is now "Find and remove
duplicate photos. Ad-free, works offline, no uploads." (69/80 chars) and the full
description gains one factual pay-once line plus a "sold through Google Play as a
one-time purchase" bullet (2,426/4,000). The price stays out of the title, icon and
developer name, because Play's metadata policy forbids price and promotional wording
there. PRIVACY.md gains a Purchases section - Google Play processes the payment, the app
has no payment code and no network access at all - and its date moves to 2026-10-14, so
the published copy needs re-pushing to Gitea.

No code changed, so the signed 1.0.1 .aab is untouched (sha256 f8e6a29a...). What is
left is Console work: a payments profile, the price and the launch sale on Products >
App pricing, and a promo-code copy to test the paid listing end to end.

README.md

@@ -164,8 +164,11 @@ the reclaimable-bytes maths.
 ./gradlew :app:testDebugUnitTest
 ```
 
-There is no instrumentation test and no emulator in this environment, so UI
-behaviour is verified on a real device via `adb install` or Play internal testing.
+There is no instrumentation test, so UI behaviour is verified by installing the debug build on a
+device or an emulator (`adb install -r app/build/outputs/apk/debug/app-debug.apk`) and driving it by
+hand or with `adb shell input tap`. That is how the store screenshots are taken; the tablet sets were
+shot on AOSP AVDs running in **software emulation**, because this machine exposes no `/dev/kvm`
+(see [docs/STORE_LISTING.md](docs/STORE_LISTING.md)).
 
 ## Releasing to Google Play
 
@@ -174,9 +177,18 @@ listing, Data Safety, release notes, rollout), [docs/STORE_LISTING.md](docs/STOR
 (ready-to-paste listing copy plus the icon / feature graphic generators) and
 [PRIVACY.md](PRIVACY.md).
 
+The app is published as a **one-time paid app** — no ads, no subscription, no in-app purchases, and
+therefore no Billing code or `com.android.vending.BILLING` permission in the APK: the price lives on
+the listing, not in the build ([why](docs/STORE_LISTING.md#app-pricing)).
+
 The upload-ready graphics and screenshots live in [`store-assets/`](store-assets/).
 `tools/make-store-assets.sh` and `tools/make-store-screenshots.sh` regenerate them from the
 app's own icon vectors and from `adb` captures — always inside the repo, never in `$HOME`.
+Screenshots are kept per form factor (`store-assets/{raw-,}screenshots/{phone,tablet-7in,tablet-10in}/`)
+because Play gives phones and each tablet size a slot of their own: `FORM_FACTOR=tablet-7in`
+selects the 7-inch pipeline, and the tablet runs deliberately crop no system chrome because a
+tablet frame is already inside Play's 2:1 cap. All three sets are captured — the phone set on a real
+device, the tablet sets on AOSP AVDs; see [docs/STORE_LISTING.md](docs/STORE_LISTING.md).
 `python3 tools/make-demo-photos.py` draws the synthetic photo library the results screenshot is
 captured over, so the listing never shows a real one.