ci: gitea actions for the suites, the image and the APK

Four workflows, none of which existed:

* `tests.yml` — backend, desktop, `:core` and the web app's typecheck+build, in
  parallel. `:core` needs no Android SDK at all, because settings.gradle.kts
  leaves `:app` out when there is none; `:app`'s Robolectric suite therefore
  lives in the APK workflow, where the SDK is installed anyway. Nothing needs a
  running backend — the suites feed on committed fixtures, which is the whole
  reason they were written that way.
* `lint.yml` — ruff, which the repo had been configured for and never run.
* `docker.yml` — builds the image, *starts* it against SQLite and waits for
  /api/health before pushing, then publishes `:latest` and `:<short-sha>` to
  git.timka.su. A tag nobody can run is worse than no tag.
* `android-release.yml` — the release APK on every push to master, signed from
  secrets, with `apksigner verify --print-certs` reporting which key was really
  used and failing if it was the debug one.

Three things the repo needed before any of that could work:

`versionCode` was pinned at 1, so every APK looked like the same version to the
phone and would not install over its predecessor. It now comes from the run
number, with `versionName` from a property, both via one `setting()` helper that
reads a Gradle property or an environment variable.

The release build fell back to the *debug* signing key whenever the keystore was
missing — silently. That is a trap: the APK installs, looks fine, and can never
be upgraded by a properly signed build. `KADENCE_REQUIRE_SIGNING=1` makes that
case fail the build instead, and the release job sets it whenever a keystore
secret is present.

The compose files built an image with no name, so there was nothing to pull.
`image:` now names the registry tag while `up --build` still builds locally.

Also: `android/ci/install-sdk.sh` (idempotent, cacheable, and the one place that
knows `platforms;android-37.0` is spelled with the minor version), the runner as
a compose service with its config and a setup checklist, six make targets, and a
README section. No runner is registered yet — `make ci-runner` is step two of
that checklist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Makefile

@@ -51,6 +51,31 @@ android-build: ## Build the debug APK (needs the Android SDK)
 android-install: ## Install the debug APK on the connected phone
 	cd android && ./gradlew :app:installDebug
 
+lint: ## ruff over the backend and the desktop app (what CI runs)
+	# From the repo root and with these arguments, exactly as `.gitea/workflows/lint.yml`
+	# does: ruff decides what counts as a first-party import from where it is invoked,
+	# so a different cwd gives a different answer about import order.
+	backend/.venv/bin/ruff check --config backend/pyproject.toml backend desktop
+
+ci-test: ## Every suite, the way CI runs them — no venv assumptions
+	python3 -m venv /tmp/kadence-ci && /tmp/kadence-ci/bin/pip install -q -e "./backend[dev]"
+	cd backend && PYTHONPATH=$$PWD /tmp/kadence-ci/bin/python -m pytest -q
+	cd desktop && /tmp/kadence-ci/bin/python -m pytest -q
+	cd android && ./gradlew :core:test :app:testDebugUnitTest
+	cd frontend && npm ci --no-audit --no-fund && npm run typecheck && npm run build
+
+glyph-sdk: ## Download the Glyph Matrix SDK into android/app/libs
+	cd android && ./fetch-glyph-sdk.sh
+
+android-sdk: ## Install the Android SDK packages this app builds against
+	./android/ci/install-sdk.sh
+
+android-release: ## Build the release APK (set KADENCE_KEYSTORE* to sign it)
+	cd android && ./gradlew :app:assembleRelease
+
+ci-runner: ## Start the Gitea Actions runner (needs GITEA_RUNNER_REGISTRATION_TOKEN)
+	docker compose -f docker-compose.ci.yml up -d
+
 report: ## Build and send today's report right now
 	cd backend && PYTHONPATH=$$PWD .venv/bin/python -m app.cli report
 
@@ -64,4 +89,4 @@ deploy: ## Push master and redeploy kadence.timka.su on sw_pl_1
 deploy-logs: ## Follow the production app log
 	ssh sw_pl_1 'cd /opt/kadence && docker compose -f docker-compose.yml -f docker-compose.prod.yml logs -f --tail 100 app'
 
-.PHONY: help up down logs dev test backend-venv web-build desktop desktop-test desktop-install helper-install android-test android-test-core android-build android-install report set-password deploy deploy-logs
+.PHONY: help up down logs dev test lint ci-test backend-venv web-build desktop desktop-test desktop-install helper-install android-test android-test-core android-build android-install android-sdk android-release glyph-sdk ci-runner report set-password deploy deploy-logs