feat(android): manual signed-APK CI workflow

Add .gitea/workflows/android-build.yaml (workflow_dispatch + confirm=build,
master-only; mirrors prod-deploy): builds the native SPA, bundles the offline
dicts, assembles a release APK as a run artifact. JDK 21 via setup-java; the
Android SDK is host-provisioned (host-executor runner) with a fail-fast verify
that also checks the runner user's access. Signing degrades gracefully — no
keystore => unsigned release APK, not a failure.

Wire ui/android/app/build.gradle: versionCode/versionName from the release tag
(-P props; '=' assignment, not the command form that binds .toInteger() to the
DSL setter's null return), plus a guarded signingConfigs.release from env.

Rename VITE_STORE_URL -> VITE_RUSTORE_URL (empty until publish).

Bake the E as-built into ANDROID_PLAN.md.

ui/android/app/build.gradle

@@ -3,12 +3,22 @@ apply plugin: 'com.android.application'
 android {
     namespace = "ru.eruditgame.app"
     compileSdk = rootProject.ext.compileSdkVersion
+
+    // Release signing is supplied by the android-build CI workflow via env: it decodes the keystore
+    // secret to a file and points ANDROID_KEYSTORE_FILE at it. A local build or a keyless CI run leaves
+    // it unset, so the release APK is produced UNSIGNED rather than failing — assembleDebug and
+    // assembleRelease both build without the keystore. The keystore is never committed (see .gitignore).
+    def keystoreFile = System.getenv('ANDROID_KEYSTORE_FILE')
+    def hasKeystore = keystoreFile != null && !keystoreFile.isEmpty() && file(keystoreFile).exists()
+
     defaultConfig {
         applicationId "ru.eruditgame.app"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 1
-        versionName "1.0"
+        // Deterministic from the release tag by the android-build workflow (vMA.MI.PA ->
+        // MA*1_000_000 + MI*1_000 + PA); the defaults keep a local assembleDebug building.
+        versionCode = (project.findProperty('versionCode') ?: '1').toInteger()
+        versionName = (project.findProperty('versionName') ?: '0.0.0').toString()
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.
@@ -16,10 +26,27 @@ android {
             ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:.*:!CVS:!thumbs.db:!picasa.ini:!*~'
         }
     }
+    signingConfigs {
+        release {
+            // Populated only when the workflow provided a keystore (see hasKeystore above); left empty
+            // otherwise so it is never referenced with a null storeFile.
+            if (hasKeystore) {
+                storeFile file(keystoreFile)
+                storePassword System.getenv('ANDROID_KEYSTORE_PASSWORD')
+                keyAlias System.getenv('ANDROID_KEY_ALIAS')
+                keyPassword System.getenv('ANDROID_KEY_PASSWORD')
+            }
+        }
+    }
     buildTypes {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'
+            // Sign only when a keystore was supplied; a keyless release build stays unsigned instead
+            // of failing.
+            if (hasKeystore) {
+                signingConfig signingConfigs.release
+            }
         }
     }
 }