Go through issues and PRs to clean up the repo for Jamulus 4

[ann0see]

We should go through the issues a d prioritize for Jamulus 4.

This means:

• Finding out missing pieces for issues
• Closing issues which won't be fixable
• Updating/creating a roadmap

[mcfnord]

🤖 AI: Cleanup pass re-run against main @ 11a28d5.

#2403 (duplicate Android permissions) — still none. The four uses-permission entries and every android:name attribute in the manifest occur exactly once: grep -oE 'android:name="[^"]+"' android/AndroidManifest.xml | sort | uniq -c returns no count above 1.

#2346 (automated dependency-update PRs) — three of its six boxes are settled by shipped config, the newest by #3848: github-actions and gitsubmodule in dependabot.yml, and the aqt/Qt6/JACK/jom/NSIS pins in the bump-dependencies matrix. A fourth box only asks to check #2345, which is closed. Two are not settled: the Android toolchain pins COMMANDLINETOOLS_VERSION=6858069 and ANDROID_NDK_VERSION=r21d are in no updater, and pylint is held at pip install --user "pylint < 3.0" with no pip ecosystem configured — so #3056, folded in here when it was closed, is unfinished.

#2519 — not covered by #3805, although its sibling #3367 closed with that merge. The first cause in the report is gone: connect/disconnect now lives in CClient behind EConnectionState. The second is not — the button still branches on pClient->IsRunning(), which returns Sound.IsRunning() rather than GetConnectionState(), and its else branch still carries // If the client isn't running, we assume that we weren't connected plus a TODO: Refactor to have robust error handling. That is the reported "shows Disconnect, opens the Connect dialog" path.

Two rows from the earlier pass still stand as partial, not for closure: #3339's regex fix (ba07f4e5) is in, while the board-assignment half has no code in create-translation-issues.sh; #1737's repo-scoped items are done (both non-GitHub actions are pinned to a commit SHA, Dependabot is on, and all six workflows constrain the token — five at workflow level, translation-check.yml at job level), with the remaining items scoped to jamuluswebsite.