feat(android): manual signed-APK CI workflow

Add .gitea/workflows/android-build.yaml (workflow_dispatch + confirm=build,
master-only; mirrors prod-deploy): builds the native SPA, bundles the offline
dicts, assembles a release APK as a run artifact. JDK 21 via setup-java; the
Android SDK is host-provisioned (host-executor runner) with a fail-fast verify
that also checks the runner user's access. Signing degrades gracefully — no
keystore => unsigned release APK, not a failure.

Wire ui/android/app/build.gradle: versionCode/versionName from the release tag
(-P props; '=' assignment, not the command form that binds .toInteger() to the
DSL setter's null return), plus a guarded signingConfigs.release from env.

Rename VITE_STORE_URL -> VITE_RUSTORE_URL (empty until publish).

Bake the E as-built into ANDROID_PLAN.md.

ui/src/components/UpdateOverlay.svelte

@@ -2,7 +2,7 @@
   // Non-dismissable "update required" cover. Shown when the gateway has refused a foreground call
   // as too old (update.svelte.ts — the client-version gate). Unlike the maintenance overlay this is
   // terminal: an installed build cannot become compatible without an actual update, so its one
-  // action takes the user to the fix — the store listing on a native build (VITE_STORE_URL, opened
+  // action takes the user to the fix — the store listing on a native build (VITE_RUSTORE_URL, opened
   // in the system browser / store app) or a plain reload on the web (which fetches the current
   // client). Mirrors MaintenanceOverlay.svelte's look.
   import { updateRequired } from '../lib/update.svelte';
@@ -13,7 +13,7 @@
     const ch = clientChannel();
     if (ch === 'android' || ch === 'ios') {
       // '_system' hands the URL to the OS (the store app / external browser) rather than the WebView.
-      const url = import.meta.env.VITE_STORE_URL;
+      const url = import.meta.env.VITE_RUSTORE_URL;
       if (url) window.open(url, '_system');
     } else {
       location.reload();