chore(ci): migrate workflows to gitea + consolidate keystore secret

- rename .forgejo/workflows/ to .gitea/workflows/ (git mv preserves
  history); Gitea Actions reads either path, but the directory now
  matches the active platform
- collapse ANDROID_STORE_PASSWORD + ANDROID_KEY_PASSWORD into a
  single ANDROID_KEYSTORE_PASSWORD secret (PKCS12 keystores require
  the two passwords to be identical, so the duplication carried no
  information); build.gradle.kts still reads two env vars to stay
  format-agnostic, both now sourced from the same secret in CI
- ignore android/*.keystore, android/*.keystore.*, android/*.jks,
  android/keystore.properties so the regenerated signing material
  never reaches a remote on accident
- update prose references from Forgejo to Gitea in CLAUDE.md and
  the docs; the historical "migrated from Forgejo" note in CLAUDE.md
  is kept intentionally; forgejo/upload-artifact@v3 action refs are
  left untouched (canonical artifact action, resolves cleanly under
  Gitea Actions)

Operator side: ANDROID_KEY_ALIAS, ANDROID_KEYSTORE_PASSWORD, and
ANDROID_KEYSTORE_B64 secrets registered in Gitea before this lands.

flutter_client/README.md

@@ -51,10 +51,10 @@ and re-run `./tool/sync_shared.sh`.
 
 ## CI
 
-`.forgejo/workflows/flutter.yml` runs on push to dev/main, tag pushes,
+`.gitea/workflows/flutter.yml` runs on push to dev/main, tag pushes,
 PR to main, and manual dispatch — path-filtered to `flutter_client/**`
 plus the shared web inputs. Steps: sync, analyze, test, build APK.
-Debug APKs upload as artifacts; release APKs attach to the Forgejo
+Debug APKs upload as artifacts; release APKs attach to the Gitea
 release on tag.
 
 ## Versioning
@@ -67,7 +67,7 @@ when a server-side change requires a paired client update.
 
 ## Distribution
 
-- **Android:** APK on the Forgejo release page. No Play Store for v1.
+- **Android:** APK on the Gitea release page. No Play Store for v1.
 - **iOS:** TestFlight on tag (manual upload v1, automate later).
 
 ## Out-of-scope for slice 1