feat(release): automate store publishing (fastlane supply + GitLab CI) and F-Droid recipe

- fastlane: Appfile/Fastfile/Gemfile with deploy_play lane (AAB -> Play internal track)
- CI: tag-gated build:android (signed AAB/APK from CI secrets) + deploy:play jobs
- F-Droid: fdroiddata build recipe at docs/fdroid/org.comunes.tane.yml
- Play compliance: Data Safety / content-rating answer sheet (docs/legal/internal)
- docs/release.md: automated tag-triggered flow, dedicated tane-upload keystore
- pubspec: description now mentions the market, not just the inventory

.gitlab-ci.yml

@@ -10,6 +10,7 @@ stages:
   - analyze
   - test
   - build
+  - deploy
 
 variables:
   PUB_CACHE: "$CI_PROJECT_DIR/.pub-cache"
@@ -82,3 +83,63 @@ test:app_seeds:
       coverage_report:
         coverage_format: cobertura
         path: apps/app_seeds/coverage/cobertura.xml
+
+# ---------------------------------------------------------------------------
+# Release automation. Runs ONLY on tags, so it never touches the per-push gate.
+# Password-free: signing + Play credentials come from masked+protected CI vars.
+# Required CI variables (Settings > CI/CD > Variables), set once:
+#   TANE_KEYSTORE_BASE64   base64 of the dedicated Tane upload keystore (.jks)
+#   TANE_KEYSTORE_PASSWORD store password
+#   TANE_KEY_ALIAS         key alias (tane-upload)
+#   TANE_KEY_PASSWORD      key password
+#   SUPPLY_JSON_KEY_DATA   Google Play service-account JSON (raw file contents)
+# Tag a commit (e.g. `git tag v0.1.0 && git push --tags`) to build + publish.
+# ---------------------------------------------------------------------------
+
+# Build the signed release artifacts (AAB for Play, APK for sideload/QA).
+build:android:
+  stage: build
+  rules:
+    - if: '$CI_COMMIT_TAG'
+  script:
+    - cd apps/app_seeds
+    - dart run slang
+    - dart run build_runner build --delete-conflicting-outputs
+    # Materialize the signing material from CI secrets (never in the repo).
+    - echo "$TANE_KEYSTORE_BASE64" | base64 -d > "$CI_PROJECT_DIR/tane-upload.jks"
+    - |
+      cat > android/key.properties <<EOF
+      storeFile=$CI_PROJECT_DIR/tane-upload.jks
+      storePassword=$TANE_KEYSTORE_PASSWORD
+      keyAlias=$TANE_KEY_ALIAS
+      keyPassword=$TANE_KEY_PASSWORD
+      EOF
+    - flutter build appbundle --release
+    - flutter build apk --release
+    # Don't leave signing material in the workspace/cache.
+    - rm -f android/key.properties "$CI_PROJECT_DIR/tane-upload.jks"
+  artifacts:
+    paths:
+      - apps/app_seeds/build/app/outputs/bundle/release/app-release.aab
+      - apps/app_seeds/build/app/outputs/flutter-apk/app-release.apk
+    expire_in: 90 days
+
+# Upload the AAB + store listing to Google Play (internal track) via fastlane.
+# Needs a Ruby image, not the Flutter one, so it overrides the global setup.
+deploy:play:
+  stage: deploy
+  image: ruby:3.2
+  needs:
+    - job: build:android
+      artifacts: true
+  rules:
+    - if: '$CI_COMMIT_TAG'
+  before_script:
+    - cd apps/app_seeds
+    - bundle install --path vendor/bundle
+  script:
+    - bundle exec fastlane deploy_play
+  cache:
+    key: "fastlane-gems"
+    paths:
+      - apps/app_seeds/vendor/bundle/