layout: restructure into src/ tests/ android/ scripts/ tools/

- extension/src/{port,platform,codepage} -> src/; native_render -> src/host
  (+ dxt, shaders/); libgr2 -> src/gr2; extension/third_party -> third_party
- extension/tests -> tests/port, libgr2/tests -> tests/gr2
- android-native -> android (build.sh, push-client.sh moved in)
- script -> scripts; tools/40250 -> tools/server; oracle -> tools/granny-oracle;
  perf tools -> tools/perf
- all build trees under build/ (native, release, android, port-gate)
- xrender:: CMake aliases -> mt::; port-map ledger impl paths rewritten

No code changes. ctest 15/15, port_gate macos+android PASS, port_map check 0 errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

third_party/cryptopp/CMakeLists.txt

@@ -0,0 +1,60 @@
+# Crypto++ 8.4.0 — vendored from the 40250 client tree
+# (ClientVS22/extern/include/cryptopp, CRYPTOPP_VERSION 840). Needed for the
+# MT_PROTOCOL=classic backend's _IMPROVED_PACKET_ENCRYPTION_ cipher:
+# DH2 key agreement + hint-selected block ciphers (Twofish default) in CTR mode.
+# The server links this exact version (Server/.../extern/cryptopp_8_4_0.tar.gz).
+#
+# No upstream CMakeLists — we glob the library TUs and drop the test / bench /
+# adhoc / FIPS-selftest ones. ASM is disabled everywhere (CRYPTOPP_DISABLE_ASM)
+# so the same pure-C++/intrinsics build works on the Android NDK and iOS SDK;
+# the classic cipher doesn't need AES-NI / SHA-ext.
+
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
+
+file(GLOB CRYPTOPP_SRC CONFIGURE_DEPENDS "${CMAKE_CURRENT_SOURCE_DIR}/*.cpp")
+
+# TUs that are the cryptest program / benchmarks / dev scratch, not the library.
+set(_cp_exclude
+    adhoc bench1 bench2 bench3 datatest dlltest fipsalgt fipstest pch
+    regtest1 regtest2 regtest3 regtest4 test
+    validat0 validat1 validat2 validat3 validat4 validat5
+    validat6 validat7 validat8 validat9 validat10)
+foreach(_n ${_cp_exclude})
+    list(REMOVE_ITEM CRYPTOPP_SRC "${CMAKE_CURRENT_SOURCE_DIR}/${_n}.cpp")
+endforeach()
+
+# Android: cpu.cpp does `#include "cpu-features.h"` (unconditionally on __ANDROID__)
+# and calls android_getCpuFeatures() etc. — those live in the NDK's cpufeatures
+# helper, which isn't on the sysroot include path by default.
+if(ANDROID)
+    set(_ndk "${CMAKE_ANDROID_NDK}")
+    if(NOT _ndk)
+        set(_ndk "$ENV{ANDROID_NDK_HOME}")
+    endif()
+    set(_cpufeat "${_ndk}/sources/android/cpufeatures")
+    if(EXISTS "${_cpufeat}/cpu-features.c")
+        list(APPEND CRYPTOPP_SRC "${_cpufeat}/cpu-features.c")
+    else()
+        message(FATAL_ERROR "cryptopp/Android: cpu-features.c not found under ${_cpufeat}")
+    endif()
+endif()
+
+add_library(cryptopp STATIC ${CRYPTOPP_SRC})
+target_include_directories(cryptopp SYSTEM PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/..")
+if(ANDROID)
+    target_include_directories(cryptopp SYSTEM PRIVATE "${_cpufeat}")
+endif()
+target_compile_features(cryptopp PUBLIC cxx_std_17)
+target_compile_definitions(cryptopp PUBLIC
+    CRYPTOPP_DISABLE_ASM
+    CRYPTOPP_DISABLE_SSSE3
+    CRYPTOPP_DISABLE_AESNI)
+# Upstream is not warning-clean under -Wall; this is vendored 3rd-party code.
+target_compile_options(cryptopp PRIVATE -w)
+if(NOT MSVC)
+    target_compile_options(cryptopp PRIVATE -fno-strict-aliasing)
+endif()
+
+# Consumers include <cryptopp/sha.h> etc. — parent dir is on the include path
+# above (third_party/), so the "cryptopp/" prefix resolves.
+add_library(mt3p::cryptopp ALIAS cryptopp)