chore(ci): migrate workflows to gitea + consolidate keystore secret

- rename .forgejo/workflows/ to .gitea/workflows/ (git mv preserves
  history); Gitea Actions reads either path, but the directory now
  matches the active platform
- collapse ANDROID_STORE_PASSWORD + ANDROID_KEY_PASSWORD into a
  single ANDROID_KEYSTORE_PASSWORD secret (PKCS12 keystores require
  the two passwords to be identical, so the duplication carried no
  information); build.gradle.kts still reads two env vars to stay
  format-agnostic, both now sourced from the same secret in CI
- ignore android/*.keystore, android/*.keystore.*, android/*.jks,
  android/keystore.properties so the regenerated signing material
  never reaches a remote on accident
- update prose references from Forgejo to Gitea in CLAUDE.md and
  the docs; the historical "migrated from Forgejo" note in CLAUDE.md
  is kept intentionally; forgejo/upload-artifact@v3 action refs are
  left untouched (canonical artifact action, resolves cleanly under
  Gitea Actions)

Operator side: ANDROID_KEY_ALIAS, ANDROID_KEYSTORE_PASSWORD, and
ANDROID_KEYSTORE_B64 secrets registered in Gitea before this lands.

.gitea/workflows/android.yml

@@ -0,0 +1,153 @@
+name: android
+
+# Native Android (Kotlin/Compose/Media3) — M8 rewrite of the Flutter client.
+# Lives side-by-side with flutter_client/ until cutover; both APKs ship from
+# their respective release artifacts (minstrel-<tag>.apk = Flutter,
+# minstrel-android-<tag>.apk = native) during the transition.
+
+on:
+  push:
+    branches: [main, dev]
+    tags: ['v*']
+    paths:
+      - 'android/**'
+      - '.gitea/workflows/android.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'android/**'
+
+env:
+  # Silences the JDK 22+ "restricted method in java.lang.System has been
+  # called" warning that Gradle 9.1's bundled native-platform jar trips
+  # at launch (System.load for native primitives). Affects the LAUNCHER
+  # JVM, not the daemon — that's why org.gradle.jvmargs in
+  # gradle.properties isn't enough. Future-compat: required opt-in once
+  # JDK 25 promotes the warning to an error.
+  JAVA_TOOL_OPTIONS: "--enable-native-access=ALL-UNNAMED"
+
+jobs:
+  build:
+    name: Build + lint + test
+    # Using flutter-ci runner label because it's the only proven-working
+    # label with docker that can pull our container.image. Switch to
+    # android-ci once the operator registers that runner label.
+    runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-android:36
+
+    defaults:
+      run:
+        working-directory: android
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache Gradle dirs
+        # Resolved deps + Gradle distribution + Kotlin daemon caches.
+        # Saves ~3 min per CI run after the first warm-up.
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+            ~/.kotlin
+          key: gradle-${{ runner.os }}-${{ hashFiles('android/gradle/wrapper/gradle-wrapper.properties', 'android/gradle/libs.versions.toml', 'android/**/*.gradle.kts') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
+      - name: Make gradlew executable
+        run: chmod +x ./gradlew
+
+      - name: Gradle wrapper validation
+        run: ./gradlew --version
+
+      - name: ktlint
+        run: ./gradlew ktlintCheck
+
+      - name: detekt
+        run: ./gradlew detekt
+
+      - name: Unit tests
+        run: ./gradlew testDebugUnitTest
+
+      - name: Assemble debug
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: ./gradlew assembleDebug
+
+      - name: Upload debug APK
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: forgejo/upload-artifact@v3
+        with:
+          name: minstrel-android-debug-${{ github.sha }}
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+
+  release:
+    name: Build signed release APK
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-android:36
+
+    defaults:
+      run:
+        working-directory: android
+
+    env:
+      # PKCS12 keystores collapse store + key password into a single
+      # value, so both env vars map to one secret. build.gradle still
+      # reads them separately to stay format-agnostic.
+      ANDROID_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+      ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+      ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Make gradlew executable
+        run: chmod +x ./gradlew
+
+      - name: Decode signing keystore
+        # Reuses the same keystore env-var contract as flutter.yml so the
+        # native APK is signed with the same key — Android will accept
+        # the upgrade in place at cutover without uninstall.
+        env:
+          ANDROID_KEYSTORE_B64: ${{ secrets.ANDROID_KEYSTORE_B64 }}
+        shell: bash
+        run: |
+          if [ -z "${ANDROID_KEYSTORE_B64}" ]; then
+            echo "::error::ANDROID_KEYSTORE_B64 missing"; exit 1
+          fi
+          KEYSTORE_PATH="${RUNNER_TEMP}/minstrel-release.keystore"
+          echo "${ANDROID_KEYSTORE_B64}" | base64 -d > "${KEYSTORE_PATH}"
+          echo "ANDROID_KEYSTORE_PATH=${KEYSTORE_PATH}" >> "${GITHUB_ENV}"
+
+      - name: Build release APK
+        run: ./gradlew assembleRelease
+
+      - name: Attach APK to release
+        # During the side-by-side period the asset name is
+        # minstrel-android-<tag>.apk so it doesn't collide with the
+        # Flutter app's minstrel-<tag>.apk. At cutover, flip this name
+        # to minstrel-<tag>.apk and deactivate the flutter.yml release-
+        # attach step (M8 phase 14.4).
+        shell: bash
+        env:
+          CI_TOKEN: ${{ secrets.CI_TOKEN }}
+        run: |
+          TAG="${GITHUB_REF#refs/tags/}"
+          REPO="${GITHUB_REPOSITORY}"
+          RELEASE_ID=$(curl -fsSL \
+            -H "Authorization: token ${CI_TOKEN}" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}" \
+            | grep -oP '"id":\s*\K[0-9]+' | head -1)
+          if [ -z "${RELEASE_ID}" ]; then
+            echo "::error::release for ${TAG} not found"; exit 1
+          fi
+          curl -fsSL \
+            -H "Authorization: token ${CI_TOKEN}" \
+            -F "attachment=@app/build/outputs/apk/release/app-release.apk" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-android-${TAG}.apk"