Sign the APK with a real key when one is configured

The APK has been debug-signed with a key generated on the spot, which is
right for putting a build on a test device and useless for anything else:
a different signature every run, so nothing can ever update in place.

Four secrets now select a real signature -- ANDROID_KEYSTORE_BASE64 and
its password, alias and key password. The names are JellyTau's, because
that repo already signs its Android build this way against this same
runner and one convention across both is one thing to remember.

Absence of the secrets is not an error. A fork or a branch build has no
access to them and should still produce an installable APK, so the debug
path stays exactly as it was. The reverse is an error: if a keystore is
supplied and cannot be read, the build fails rather than quietly falling
back to a debug key, because a release that is silently debug-signed is
worse than no release.

Passwords reach apksigner and keytool as `env:`, never `pass:`. `pass:`
puts the password in the process table for anything on the box to read.
The keystore is written to a 0700 mktemp directory and never into the
workspace, which is both what actions/cache saves and what the upload
step globs.

Also: upload-artifact drops from v4 to v3. v4 was a guess about what this
Gitea supports. v3 is what JellyTau uploads its APK with on this runner
today, which makes it the version known to work rather than the one that
ought to.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/build-and-test.yml

@@ -295,20 +295,45 @@ jobs:
       - name: Package the APK
         env:
           CARGO_TARGET_DIR: target-android
+          # Absent secrets mean a debug signature, which is what a fork or a
+          # branch build should get. Set all three (see docs/android-signing.md)
+          # and the same job produces a release-signed APK instead.
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
         run: |
           set -e
           KEYDIR="$(mktemp -d)"
+          chmod 700 "$KEYDIR"
           trap 'rm -rf "$KEYDIR"' EXIT
-          REPO="$PWD" \
-          TARGET_DIR="$PWD/target-android" \
-          KEYSTORE="$KEYDIR/debug.keystore" \
+
+          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
+            # The keystore reaches the runner base64-encoded because a secret
+            # is a string. It is written under a 0700 mktemp directory, never
+            # into the workspace: `target-android` is what actions/cache saves,
+            # and the upload step globs the workspace.
+            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$KEYDIR/release.keystore"
+            export KEYSTORE="$KEYDIR/release.keystore"
+          else
+            # Not an error. Unset the rest so assemble-apk.sh takes its debug
+            # path cleanly rather than seeing a half-configured release one.
+            export KEYSTORE="$KEYDIR/debug.keystore"
+            unset KEYSTORE_PASS KEY_PASS KEY_ALIAS
+          fi
+
+          REPO="$PWD" TARGET_DIR="$PWD/target-android" \
             bash docker/android/assemble-apk.sh
 
+      # v3, not v4. v4 is untested against this Gitea and its runner; v3 is
+      # what JellyTau uploads its APK with on this same runner, so it is the
+      # version known to work here rather than the version that ought to.
+      #
       # `if-no-files-found: error` because the failure this guards against is
       # a green run with an empty artefact list, which reads as success until
       # somebody goes looking for the file.
       - name: Upload the APK
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v3
         with:
           name: darkroom-arm64-v8a-apk
           path: target-android/apk/darkroom.apk