ci(android): make APK attach failures visible (set -euxo + HTTP code)

The previous version of the Attach APK to release step ran without
set -x and without capturing the upload's HTTP response. Run 118
(v2026.06.01 tag-build) shows the step reporting success but the
release ended up with zero assets — i.e. the upload silently failed
without surfacing a non-zero exit.

New version:
- set -euxo pipefail so every command is echoed and any failure
  surfaces.
- ls -lh the APK before upload so we can see if Gradle even produced
  it at the expected path.
- curl -w '%{http_code}' captures the actual HTTP status into a var
  and writes the response body to a temp file; both are printed.
- Explicit if check on the HTTP code (200-299 = success) bails
  loudly when it isn't.

No behavioral change in success path; on failure the cause is
visible in the log instead of being eaten.

.gitea/workflows/android.yml

@@ -143,20 +143,39 @@ jobs:
         # release.yml's bundled in-app-update fetcher (which polls this
         # exact filename) resolves to the native APK with no further
         # workflow plumbing.
+        #
+        # Previous version of this step silently exited 0 on a failed
+        # upload because the curl exit code was being swallowed by the
+        # implicit shell. set -euxo pipefail surfaces it, and -w "...\n"
+        # forces curl to print the HTTP status of the upload so a 4xx
+        # is visible in the log.
         shell: bash
         env:
           CI_TOKEN: ${{ secrets.CI_TOKEN }}
         run: |
+          set -euxo pipefail
           TAG="${GITHUB_REF#refs/tags/}"
           REPO="${GITHUB_REPOSITORY}"
-          RELEASE_ID=$(curl -fsSL \
+          APK_PATH="app/build/outputs/apk/release/app-release.apk"
+          ls -lh "${APK_PATH}"
+
+          RELEASE_JSON="$(curl -fsSL \
             -H "Authorization: token ${CI_TOKEN}" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}" \
-            | grep -oP '"id":\s*\K[0-9]+' | head -1)
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/tags/${TAG}")"
+          RELEASE_ID="$(printf '%s' "${RELEASE_JSON}" | grep -oP '"id":\s*\K[0-9]+' | head -1)"
           if [ -z "${RELEASE_ID}" ]; then
             echo "::error::release for ${TAG} not found"; exit 1
           fi
-          curl -fsSL \
+          echo "release_id=${RELEASE_ID}"
+
+          UPLOAD_HTTP=$(curl -sS -L -o /tmp/upload.out -w '%{http_code}' \
             -H "Authorization: token ${CI_TOKEN}" \
-            -F "attachment=@app/build/outputs/apk/release/app-release.apk" \
-            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk"
+            -F "attachment=@${APK_PATH}" \
+            "https://git.fabledsword.com/api/v1/repos/${REPO}/releases/${RELEASE_ID}/assets?name=minstrel-${TAG}.apk")
+          echo "upload_http=${UPLOAD_HTTP}"
+          cat /tmp/upload.out || true
+          echo
+          if [ "${UPLOAD_HTTP}" -lt 200 ] || [ "${UPLOAD_HTTP}" -ge 300 ]; then
+            echo "::error::APK upload returned HTTP ${UPLOAD_HTTP}"
+            exit 1
+          fi