ci: publish a test APK as a pre-release for outside testers

Gitea artifacts need an account with read access to download, which makes
them useless for handing a build to someone outside the project -- the
actual reason a test APK gets built in the first place.

An optional publish input attaches the APK to a pre-release instead,
whose assets are a plain public URL on a public repo. No merge to master,
no MR, no version tag, and the tester needs no account.

Safe from a feature branch on two counts. The tag is test-<branch> rather
than v*, and only v* triggers build-release.yml, so nothing else reacts
to it. And it cannot reach existing users: the desktop updater reads a
static latest.json from the updater branch, not the release list.

Re-dispatching the same branch replaces the APK on the existing
pre-release rather than accumulating one release per attempt.

src-tauri/android/README_ANDROID_BUILD.md

@@ -110,6 +110,25 @@ two other projects, so building on every feature-branch commit would starve
 them. The APK lands as the `jellytau-test-apk` artifact (7-day retention), named
 for the branch and short SHA, with its size and SHA256 in the run summary.
 
+#### Sending a build to an outside tester
+
+Gitea **artifacts require an account** with read access to download, so an
+artifact is no use to someone outside the project. Tick **`publish`** on the
+dispatch and the APK is also attached to a **pre-release**, whose assets are a
+plain public URL on a public repo — no account, no MR, no merge to `master`.
+
+Two things make that safe to do from a feature branch:
+
+- The tag is `test-<branch>`, **not** `v*`. Only `v*` triggers
+  `build-release.yml`, so nothing else reacts to it.
+- It cannot reach existing users. The desktop updater reads a static
+  `latest.json` from the `updater` branch, not the release list, so a
+  pre-release published this way is invisible to anyone without the link.
+
+Re-dispatching for the same branch replaces the APK on the existing
+pre-release rather than piling up one release per attempt. Delete the release
+when testing is over.
+
 ### Key Files
 
 Player-related Kotlin files: