ci: publish :latest from main + native APK as minstrel-<tag>.apk

Two related cutover changes so the rolling stable channel works end
to end after the Flutter sunset.

release.yml:
- Main pushes now tag both :main and :latest. Main is the protected
  post-PR-merge branch and the team's stable channel; pinning to
  :latest gets the newest main automatically while :vX.Y.Z stays
  available for pinned consumers.

android.yml:
- Asset attach renamed from minstrel-android-<tag>.apk to
  minstrel-<tag>.apk (M8 phase 14.4 cutover). Without this, the
  server image's bundled in-app-update fetcher in release.yml polls
  a filename that no workflow produces, so /api/client/version
  returns 404 and the web UI's MobileAppDownload silently renders
  nothing. With this rename the existing fetcher resolves to the
  native APK with no further plumbing.

No code paths change; both fixes are workflow rewires.

.gitea/workflows/release.yml

@@ -2,7 +2,7 @@ name: release
 
 # Builds and pushes the minstrel container image to the Gitea registry.
 #
-#   push to main         → :main
+#   push to main         → :main and :latest
 #   push tag vX.Y.Z      → :vX.Y.Z and :latest
 #   workflow_dispatch    → manual trigger (same rules based on the ref)
 
@@ -55,9 +55,13 @@ jobs:
             echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "::notice::Release build: ${VERSION} + latest"
           else
-            echo "args=-t ${IMAGE}:main" >> "$GITHUB_OUTPUT"
+            # Main is the protected, post-PR-merge branch. Treat it as the
+            # rolling stable channel — every main push moves :latest.
+            # Pinned consumers can target :vX.Y.Z; everyone else gets the
+            # newest main.
+            echo "args=-t ${IMAGE}:main -t ${IMAGE}:latest" >> "$GITHUB_OUTPUT"
             echo "version=main" >> "$GITHUB_OUTPUT"
-            echo "::notice::Main-branch build: :main"
+            echo "::notice::Main-branch build: :main + :latest"
           fi
 
       - name: Registry login