feat: set up signed release pipeline for Forgejo

Adds env-var-driven release signing, fastlane metadata for F-Droid/Obtainium
listings, and a tag-triggered .forgejo workflow that builds, signs, and
publishes the APK as a Forgejo release.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

android/app/build.gradle

@@ -33,11 +33,19 @@ android {
         targetSdkVersion 34
     }
 
+    signingConfigs {
+        release {
+            storeFile = System.getenv("KEYSTORE_PATH") ? file(System.getenv("KEYSTORE_PATH")) : null
+            storePassword = System.getenv("STORE_PASSWORD")
+            keyAlias = System.getenv("KEY_ALIAS")
+            keyPassword = System.getenv("KEY_PASSWORD")
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.debug
+            // Falls back to the debug keys locally, so `flutter run --release` keeps working.
+            signingConfig = System.getenv("KEYSTORE_PATH") ? signingConfigs.release : signingConfigs.debug
         }
     }
 }