feat(release): automate store publishing (fastlane supply + GitLab CI) and F-Droid recipe

- fastlane: Appfile/Fastfile/Gemfile with deploy_play lane (AAB -> Play internal track)
- CI: tag-gated build:android (signed AAB/APK from CI secrets) + deploy:play jobs
- F-Droid: fdroiddata build recipe at docs/fdroid/org.comunes.tane.yml
- Play compliance: Data Safety / content-rating answer sheet (docs/legal/internal)
- docs/release.md: automated tag-triggered flow, dedicated tane-upload keystore
- pubspec: description now mentions the market, not just the inventory

apps/app_seeds/.gitignore

@@ -43,3 +43,10 @@ app.*.map.json
 /android/app/debug
 /android/app/profile
 /android/app/release
+
+# Release automation (fastlane supply). Credentials come from CI secrets or a
+# gitignored local file; generated reports are not tracked.
+/play-service-account.json
+/fastlane/report.xml
+/fastlane/Preview.html
+/Gemfile.lock

apps/app_seeds/Gemfile

@@ -0,0 +1,5 @@
+# Ruby toolchain for release automation (fastlane supply -> Google Play).
+# Run from apps/app_seeds/:  bundle install && bundle exec fastlane deploy_play
+source "https://rubygems.org"
+
+gem "fastlane"

apps/app_seeds/fastlane/Appfile

@@ -0,0 +1,9 @@
+# Google Play identity + credentials for `fastlane supply`.
+#
+# The service-account JSON is injected from CI as the SUPPLY_JSON_KEY_DATA
+# secret (raw file contents) and is NEVER committed. Locally you can instead
+# export SUPPLY_JSON_KEY_DATA, or drop a gitignored play-service-account.json
+# and point json_key_file at it.
+package_name("org.comunes.tane")
+
+json_key_data_raw(ENV["SUPPLY_JSON_KEY_DATA"]) if ENV["SUPPLY_JSON_KEY_DATA"]

apps/app_seeds/fastlane/Fastfile

@@ -0,0 +1,37 @@
+# Fastlane lanes for Tane (org.comunes.tane).
+#
+# Publishing is automated and password-free: a git tag triggers CI, which builds
+# a signed AAB and runs `deploy_play`. Credentials come from CI secrets, never
+# typed by hand:
+#   SUPPLY_JSON_KEY_DATA  Google Play service-account JSON (raw contents)
+#
+# The store listing (titles, descriptions, changelogs, screenshots) is read
+# straight from fastlane/metadata/android/<locale>/ — the tree that already
+# feeds the landing site and F-Droid. See docs/release.md and .gitlab-ci.yml.
+
+default_platform(:android)
+
+# Release bundle produced by `flutter build appbundle --release`, relative to
+# the app dir (apps/app_seeds), which is where fastlane runs.
+AAB_PATH = "build/app/outputs/bundle/release/app-release.aab".freeze
+
+platform :android do
+  desc "Upload the signed AAB + store listing to Google Play (internal track)"
+  lane :deploy_play do
+    supply(
+      track: "internal",
+      aab: AAB_PATH,
+      release_status: "completed", # internal testing has no review delay
+      skip_upload_apk: true,       # we ship the AAB, not a raw APK
+      skip_upload_changelogs: false,
+    )
+  end
+
+  desc "Push only the store listing (text + images), no binary"
+  lane :deploy_metadata do
+    supply(
+      skip_upload_aab: true,
+      skip_upload_apk: true,
+    )
+  end
+end

apps/app_seeds/pubspec.yaml

@@ -1,5 +1,5 @@
 name: tane
-description: "Tane — local-first, encrypted, decentralized traditional-seed inventory."
+description: "Tane — local-first, encrypted, decentralized traditional-seed inventory and market."
 publish_to: 'none'
 version: 0.1.0+1