Republish setup: fastlane + Forgejo CI, signing/version fixes, Play-policy link

- support_page: repoint comunes.org link to project page (Play re-approval)
- build.gradle: conditional release signing (debug fallback), versionCode/Name
  from pubspec, drop duplicate google-services plugin
- pubspec: version 1.10.0+10 (versionCode must exceed last uploaded)
- track AndroidManifest.xml (no secrets in it)
- fastlane: Appfile/Fastfile (deploy_play/deploy_metadata/promote_production) +
  Gemfile + es/en/gl store metadata
- .forgejo: ci.yml (analyze+test) + release.yml (tag v* -> signed AAB -> Play internal)
- README + RELEASE.md

.forgejo/workflows/ci.yml

@@ -0,0 +1,54 @@
+# Per-push gate for git.comunes.org (Forgejo Actions): analyze + tests.
+# Flutter pinned to the developer toolchain (3.41.9).
+#
+# NOTE: `runs-on` must match a label your Forgejo runner registered with.
+# We check out with plain git (a `run:` step) instead of actions/checkout@v4:
+# the cirruslabs/flutter image has no Node.js, and JS-based actions need it
+# ("exec: node: not found"). Manual checkout keeps the workflow Node-free.
+
+name: ci
+
+on:
+  push:
+    branches: ['**']
+  pull_request:
+
+jobs:
+  analyze:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+      - run: flutter pub get
+      - name: Generate code (json_serializable)
+        run: dart run build_runner build --delete-conflicting-outputs
+      - run: flutter analyze
+
+  test:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+      - run: flutter pub get
+      - name: Generate code + test
+        run: |
+          dart run build_runner build --delete-conflicting-outputs
+          flutter test

.forgejo/workflows/release.yml

@@ -0,0 +1,91 @@
+# Release automation for git.comunes.org (Forgejo Actions).
+#
+# Password-free: pushing a tag `v*` builds a signed AAB and uploads it to
+# Google Play's internal track via fastlane. All credentials come from repo
+# secrets (Settings > Actions > Secrets), never typed:
+#   FIRES_KEYSTORE_BASE64        base64 of the org.comunes.fires upload keystore
+#   FIRES_KEYSTORE_PASSWORD      store password
+#   FIRES_KEY_ALIAS              key alias
+#   FIRES_KEY_PASSWORD           key password
+#   SUPPLY_JSON_KEY_DATA         Google Play service-account JSON (shared Comunes)
+#   FIRES_PRIVATE_SETTINGS_JSON  contents of assets/private-settings.json
+#   FIRES_GOOGLE_SERVICES_JSON   base64 of android/app/google-services.json
+#
+# Build + deploy live in ONE job so the AAB never has to cross a job boundary.
+# NOTE: `runs-on` must match a label your Forgejo runner registered with.
+
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  android:
+    runs-on: docker
+    container:
+      image: ghcr.io/cirruslabs/flutter:3.41.9
+    steps:
+      # Manual git checkout (no Node): the flutter image has no node, so JS
+      # actions like actions/checkout@v4 fail with "exec: node: not found".
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
+
+      - name: Materialize runtime secrets (Firebase + private settings)
+        env:
+          FIRES_GOOGLE_SERVICES_JSON: ${{ secrets.FIRES_GOOGLE_SERVICES_JSON }}
+          FIRES_PRIVATE_SETTINGS_JSON: ${{ secrets.FIRES_PRIVATE_SETTINGS_JSON }}
+        run: |
+          echo "$FIRES_GOOGLE_SERVICES_JSON" | base64 -d > android/app/google-services.json
+          printf '%s' "$FIRES_PRIVATE_SETTINGS_JSON" > assets/private-settings.json
+
+      - name: Materialize signing material from secrets
+        env:
+          FIRES_KEYSTORE_BASE64: ${{ secrets.FIRES_KEYSTORE_BASE64 }}
+          FIRES_KEYSTORE_PASSWORD: ${{ secrets.FIRES_KEYSTORE_PASSWORD }}
+          FIRES_KEY_ALIAS: ${{ secrets.FIRES_KEY_ALIAS }}
+          FIRES_KEY_PASSWORD: ${{ secrets.FIRES_KEY_PASSWORD }}
+        run: |
+          echo "$FIRES_KEYSTORE_BASE64" | base64 -d > "$GITHUB_WORKSPACE/fires-upload.jks"
+          cat > android/key.properties <<EOF
+          storeFile=$GITHUB_WORKSPACE/fires-upload.jks
+          storePassword=$FIRES_KEYSTORE_PASSWORD
+          keyAlias=$FIRES_KEY_ALIAS
+          keyPassword=$FIRES_KEY_PASSWORD
+          EOF
+
+      - name: Generate code (json_serializable)
+        run: |
+          flutter pub get
+          dart run build_runner build --delete-conflicting-outputs
+
+      - name: Build signed AAB + APK (production flavor)
+        run: |
+          flutter build appbundle --release --flavor production -t lib/main_prod.dart
+          flutter build apk --release --flavor production -t lib/main_prod.dart
+
+      - name: Install fastlane
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq ruby ruby-dev build-essential
+          gem install bundler --no-document
+          bundle install
+
+      - name: Publish to Google Play (internal track)
+        env:
+          SUPPLY_JSON_KEY_DATA: ${{ secrets.SUPPLY_JSON_KEY_DATA }}
+        run: bundle exec fastlane deploy_play
+
+      - name: Scrub secrets
+        if: always()
+        run: |
+          rm -f android/key.properties "$GITHUB_WORKSPACE/fires-upload.jks"
+          rm -f android/app/google-services.json assets/private-settings.json