fix(release): port store publishing to Forgejo Actions (canonical remote is Forgejo)

git.comunes.org runs Forgejo Actions, not GitLab CI, so the tag-triggered
signed-AAB build + fastlane Play upload now lives in .forgejo/workflows/release.yml
(single job, no cross-job artifact passing). Removed the equivalent GitLab jobs;
.gitlab-ci.yml keeps only the analyze/test gate. Play service account is reused
from Ğ1nkgo. docs/release.md updated (Forgejo secrets).

.forgejo/workflows/release.yml

@@ -0,0 +1,78 @@
+# Release automation for git.comunes.org (Forgejo Actions).
+#
+# Password-free: pushing a tag `v*` builds a signed AAB/APK and uploads it to
+# Google Play's internal track via fastlane. All credentials come from repo
+# secrets (Settings > Actions > Secrets), never typed:
+#   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
+#   TANE_KEYSTORE_PASSWORD store password
+#   TANE_KEY_ALIAS         tane-upload
+#   TANE_KEY_PASSWORD      key password
+#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (reused from Ğ1nkgo)
+#
+# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
+# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
+# if the Comunes runner uses something other than `docker`.
+
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  android:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Generate code (i18n + Drift)
+        working-directory: apps/app_seeds
+        run: |
+          flutter pub get
+          dart run slang
+          dart run build_runner build --delete-conflicting-outputs
+
+      - name: Materialize signing material from secrets
+        working-directory: apps/app_seeds
+        env:
+          TANE_KEYSTORE_BASE64: ${{ secrets.TANE_KEYSTORE_BASE64 }}
+          TANE_KEYSTORE_PASSWORD: ${{ secrets.TANE_KEYSTORE_PASSWORD }}
+          TANE_KEY_ALIAS: ${{ secrets.TANE_KEY_ALIAS }}
+          TANE_KEY_PASSWORD: ${{ secrets.TANE_KEY_PASSWORD }}
+        run: |
+          echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/tane-upload.jks"
+          cat > android/key.properties <<EOF
+          storeFile=$GITHUB_WORKSPACE/tane-upload.jks
+          storePassword=$TANE_KEYSTORE_PASSWORD
+          keyAlias=$TANE_KEY_ALIAS
+          keyPassword=$TANE_KEY_PASSWORD
+          EOF
+
+      - name: Build signed AAB + APK
+        working-directory: apps/app_seeds
+        run: |
+          flutter build appbundle --release
+          flutter build apk --release
+
+      - name: Install fastlane
+        working-directory: apps/app_seeds
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq ruby ruby-dev build-essential
+          gem install bundler --no-document
+          bundle install
+
+      - name: Publish to Google Play (internal track)
+        working-directory: apps/app_seeds
+        env:
+          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
+        run: bundle exec fastlane deploy_play
+
+      - name: Scrub signing material
+        if: always()
+        working-directory: apps/app_seeds
+        run: rm -f android/key.properties "$GITHUB_WORKSPACE/tane-upload.jks"