docs: record /card audit fixes; gitignore native plugin gradle build output

.gitignore

@@ -60,3 +60,7 @@ push-service/bun.lock
 # (DEPLOY.md does `cp package.cvm.json package.json` on the server).
 cvm-server/package.json
 *.bak
+
+# Native plugin gradle build output (local plugins)
+packages/*/android/build/
+packages/*/android/.gradle/

AGENTS.md

@@ -147,6 +147,14 @@ session with **no other memory of this project**. So:
     the NFC permission (the plugin needs `androidx.appcompat` on its classpath —
     Capacitor's `activity` is an `AppCompatActivity`). Tag-writing still needs a
     **device test** (the plugin is otherwise unverified).
+    **Audit fixes (2026-10-02):** removed the now-dead **stats** (the redesign
+    dropped the stats row, so the `show` flags are only crews/local/roles and
+    `spotsAdded/zapsReceived/eventsCreated/memberYear` are gone from the card
+    types); **holographic is persisted** (`holo` tag); the **public card derives
+    style/level** from the Skater profile (was `config.style` = ''); the **share
+    link** is `/#/card/<npub>` (was a path HashRouter ignored); **issued passes
+    dedupe by `d`** (a revoke no longer shows two rows); PNG download is labelled
+    "Save front (PNG)" when a back exists.
 - **Marketplace**: `GearSwapPage` (grid) + `MarketplaceItemCard` and a listing
   detail page at **`/listing/:pubkey/:identifier`**. Trade/escrow actions live in
   the shared **`ListingTradeActions`** (used by BOTH the card and the detail page