docs: fix incorrect server config keys, API security notes, and F-Droid status

[0xbrayo]

Fixes several statements in the docs that no longer match the code.

configuration.rst

• aw-server-rust: the bind setting is address, not host, and the keys live at the top level of config.toml (no [server] section). Also documents cors_regex, custom_static, and [auth] api_key.
• aw-server-python: removes mongodb from the storage options (the MongoDB storage was removed from aw-core) and adds sqlite; documents query_cache and custom_static.
• Both: binding is not limited to localhost/127.0.0.1. Any address works; non-local addresses skip the Host-header check and expose the server to the network. Links to the remote-server page instead.

remote-server.rst

• The "Opening the server to the network" example used [server] address = ..., which neither server reads (Python uses host, Rust has no [server] section and uses cors, not cors_origins). Split it into a correct example for each server.
• "There is no API security" → the API is unauthenticated by default; aw-server-rust has an opt-in API key, though it travels over plain HTTP.

api/rest.rst

• The "REST Security" note said security consists only of rejecting non-localhost connections. It now mentions the opt-in Bearer-token auth in aw-server-rust.

getting-started.rst

• The Android tab linked a closed (2022) fdroiddata MR as "work in progress". The app is on F-Droid now, so this links the F-Droid listing instead.

Built locally with Sphinx; no new warnings on the changed pages.