feat(app): scan a printed seed label back into its record

Closes the physical↔digital loop the labels opened: the QR on a printed
envelope (tane://seed, already encoded by seed_label_codec) can now be
scanned from the inventory bar. A known label opens its variety; an
unknown one asks before adding anything, then creates the variety (species
linked by exact scientific name when bundled) with a lot carrying the
label's year and origin. Scanner is pure ZXing (zxing_barcode_scanner,
MIT) — no ML Kit, no Play Services, F-Droid-safe, the stack Ğ1nkgo ships.
Mobile-only; other platforms don't show the button (OCR precedent).
The post-scan flow is a plain function (handleScannedPayload) so it's
widget-tested without a camera.

.forgejo/workflows/release.yml

@@ -1,7 +1,9 @@
 # Release automation for git.comunes.org (Forgejo Actions).
 #
-# Password-free: pushing a tag `v*` builds a signed AAB/APK and uploads it to
-# Google Play's internal track via fastlane. All credentials come from repo
+# Password-free: pushing a tag `v*` builds a signed AAB + per-ABI APKs, uploads
+# the AAB to Google Play's internal track via fastlane, and attaches the signed
+# per-ABI APKs to the Forgejo release (the reference binaries F-Droid verifies
+# for reproducible, developer-signed publishing). All credentials come from repo
 # secrets (Settings > Actions > Secrets), never typed:
 #   TANE_KEYSTORE_BASE64   base64 of the dedicated tane-upload.jks
 #   TANE_KEYSTORE_PASSWORD store password
@@ -61,11 +63,33 @@ jobs:
           keyPassword=$TANE_KEY_PASSWORD
           EOF
 
-      - name: Build signed AAB + APK
+      - name: Build signed AAB + per-ABI APKs
         working-directory: apps/app_seeds
         run: |
           flutter build appbundle --release
-          flutter build apk --release
+          # Per-ABI splits: these are the reference binaries F-Droid rebuilds and
+          # verifies against (see docs/fdroid/org.comunes.tane.yml, binary:).
+          flutter build apk --release --split-per-abi
+
+      - name: Publish signed per-ABI APKs to the Forgejo release
+        working-directory: apps/app_seeds
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          apt-get update -qq && apt-get install -y -qq curl jq
+          api="http://forgejo:3000/api/v1/repos/${GITHUB_REPOSITORY}"
+          tag="${GITHUB_REF_NAME}"
+          # Create the release for this tag if it does not exist yet, then get its id.
+          curl -sf -X POST "$api/releases" \
+            -H "Authorization: token ${TOKEN}" -H 'Content-Type: application/json' \
+            -d "{\"tag_name\":\"${tag}\",\"name\":\"${tag}\"}" >/dev/null || true
+          rid=$(curl -sf -H "Authorization: token ${TOKEN}" "$api/releases/tags/${tag}" | jq -r .id)
+          for abi in armeabi-v7a arm64-v8a x86_64; do
+            f="build/app/outputs/flutter-apk/app-${abi}-release.apk"
+            curl -sf -X POST "$api/releases/${rid}/assets?name=app-${abi}-release.apk" \
+              -H "Authorization: token ${TOKEN}" \
+              -F "attachment=@${f};type=application/vnd.android.package-archive"
+          done
 
       - name: Install fastlane
         working-directory: apps/app_seeds