feat(android): back up the files of folders the person chooses

A Files section takes folders through the system picker (no storage
permission), refuses DCIM, Pictures and Movies, skips what the photo backup
sends, and runs on the photo backup's own runner into <folder>/<account>-drive.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 31 insertions, 2 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 4c376ea..bc6e20a 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -3454,7 +3454,7 @@ foreground service (`BackupService`) and the WebView reported visible, like a
 cast (§11.3). Android 15 limits that type to six hours a day; the service stops
 when told and the run carries on at the next opening.
 
-### 9.13 Contacts, calendar and messages backup (Android)
+### 9.13 Contacts, calendar, messages and files backup (Android)
 
 The Android application sends a copy of the phone's **contacts**, its
 **calendars** and its **text messages** to a folder of a group, on the photo backup's terms (§9.12): a client
@@ -3497,6 +3497,22 @@ character references and leaving out the characters XML 1.0 cannot carry.
 A contact name is filled in only when the person also allowed contacts. MMS
 are not included.
 
+**Files.** `<folder>/<account>-drive/<chosen folder>/…`: the files of the
+folders the person chose through the system's picker
+(`ACTION_OPEN_DOCUMENT_TREE`, a persisted read grant per folder, no storage
+permission, which Play keeps for a few kinds of application). It runs as
+photos do, and is in fact the same runner (`createBackup` in `photo-sync.js`,
+`drive-sync.js`): once a day, on an unmetered network, a file at a time under
+a slot, read from the phone a range at a time (`/drivesync/<token>`), a ledger
+by document id (`DriveLedger.kt`), additive. A file changed on the phone goes
+beside the copy sent, named `-modified-<date>`; nothing is replaced. Nothing
+is stored twice: `DCIM`, `Pictures` and `Movies` (or anything in them) and a
+whole volume cannot be chosen (`DrivePlan.refusal`), and a file the photo
+backup sends, wherever its album is, is left out by its path. Android 11 and
+later do not let an application choose the whole of `Download`, only folders
+in it; the section says so. Hidden files (`.x`) are skipped; a name the node
+would refuse is mended (`DrivePlan.safeName`), never dropped.
+
 **Two builds.** Play's policy gives `READ_SMS` to the default SMS application
 only, so the APK has a `store` dimension: `full`, distributed directly, and
 `play`, which has neither the permission (`src/full/AndroidManifest.xml`) nor
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 7434be2..207e57e 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -389,7 +389,8 @@ that matters to you.
 ### Backing up your phone
 
 On the Android application, **Phone → Android Sync** in the side menu backs up
-your phone's photos, contacts, calendar and text messages to a group.
+your phone's photos, contacts, calendar, text messages and the files of
+folders you choose to a group.
 
 Only your **personal profile** is backed up. If your phone has a work profile,
 nothing in it is sent, and MeshBay installed inside the work profile offers no
@@ -466,6 +467,18 @@ backup at all.
 - The version of the application from the Play Store has no text messages
   backup: Play allows reading them only to the phone's messaging application.
 
+#### Files
+
+- **Add a folder** opens Android's folder picker: choose `Documents`, a folder
+  inside `Download`, or any folder of your own. Android does not let an
+  application take the whole of `Download`.
+- `DCIM`, `Pictures` and `Movies` cannot be chosen: photos and videos are the
+  photo backup's, and a file it already sends is never sent twice.
+- The files go into `alice-drive/<folder>/`, sub-folders kept, on Wi-Fi once a
+  day like photos. A file you change on the phone is sent again beside the
+  earlier copy, with `-modified-` and the date in its name; nothing is ever
+  replaced, and a file you delete on the phone stays in the group.
+
 If a backup cannot go on (the node's disk is full, the folder no longer accepts
 files, somebody else joined the group), it stops, says why once in a
 notification and on the Android Sync page, and tries again the next day.