ci: gitea actions for the suites, the image and the APK

Four workflows, none of which existed:

* `tests.yml` — backend, desktop, `:core` and the web app's typecheck+build, in
  parallel. `:core` needs no Android SDK at all, because settings.gradle.kts
  leaves `:app` out when there is none; `:app`'s Robolectric suite therefore
  lives in the APK workflow, where the SDK is installed anyway. Nothing needs a
  running backend — the suites feed on committed fixtures, which is the whole
  reason they were written that way.
* `lint.yml` — ruff, which the repo had been configured for and never run.
* `docker.yml` — builds the image, *starts* it against SQLite and waits for
  /api/health before pushing, then publishes `:latest` and `:<short-sha>` to
  git.timka.su. A tag nobody can run is worse than no tag.
* `android-release.yml` — the release APK on every push to master, signed from
  secrets, with `apksigner verify --print-certs` reporting which key was really
  used and failing if it was the debug one.

Three things the repo needed before any of that could work:

`versionCode` was pinned at 1, so every APK looked like the same version to the
phone and would not install over its predecessor. It now comes from the run
number, with `versionName` from a property, both via one `setting()` helper that
reads a Gradle property or an environment variable.

The release build fell back to the *debug* signing key whenever the keystore was
missing — silently. That is a trap: the APK installs, looks fine, and can never
be upgraded by a properly signed build. `KADENCE_REQUIRE_SIGNING=1` makes that
case fail the build instead, and the release job sets it whenever a keystore
secret is present.

The compose files built an image with no name, so there was nothing to pull.
`image:` now names the registry tag while `up --build` still builds locally.

Also: `android/ci/install-sdk.sh` (idempotent, cacheable, and the one place that
knows `platforms;android-37.0` is spelled with the minor version), the runner as
a compose service with its config and a setup checklist, six make targets, and a
README section. No runner is registered yet — `make ci-runner` is step two of
that checklist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.ci.yml

@@ -0,0 +1,48 @@
+# The Gitea Actions runner, for a single-machine Gitea.
+#
+# Nothing in .gitea/workflows runs until a runner is registered, and this is the
+# whole of it. Two settings do the work:
+#
+#   * the **label map** decides what `runs-on: ubuntu-latest` means. It is pinned
+#     to catthehacker/ubuntu:act-24.04 because the workflows need two things from
+#     the image: a node (Gitea's javascript actions — checkout, cache,
+#     upload-artifact — run *inside* the job container) and Python 3.12, which
+#     the backend's `requires-python` insists on. Ubuntu 24.04 ships 3.12.
+#   * the **docker socket**, mounted into job containers so the `docker` workflow
+#     can build and push an image. That is a real privilege handed to CI; it is
+#     also the normal arrangement when Gitea and its runner are the same box as
+#     the deployment.
+#
+# Setting it up:
+#
+#   1. Gitea → Settings → Actions → Runners → "Create new runner", copy the token.
+#   2. GITEA_RUNNER_REGISTRATION_TOKEN=<token> docker compose -f docker-compose.ci.yml up -d
+#   3. Repository → Settings → Actions → Secrets, add:
+#        REGISTRY_USER, REGISTRY_TOKEN            — a Gitea user and token with
+#                                                   package:write, for the registry
+#        KADENCE_KEYSTORE_BASE64                  — base64 -w0 of your keystore
+#        KADENCE_KEYSTORE_PASSWORD, KADENCE_KEY_ALIAS, KADENCE_KEY_PASSWORD
+#      Without the keystore secrets the APK job still runs and produces an
+#      unsigned-for-release (debug-signed) artifact rather than failing.
+#
+# Gitea itself needs `[actions] ENABLED = true` in app.ini, and
+# `DEFAULT_ACTIONS_URL = github` so `actions/checkout@v4` can be resolved.
+services:
+  runner:
+    image: gitea/act_runner:0.2.11
+    restart: unless-stopped
+    environment:
+      GITEA_INSTANCE_URL: ${GITEA_INSTANCE_URL:-https://git.timka.su}
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:?set this to the token from Gitea}
+      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-kadence-runner}
+      GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-24.04
+      # Mounted into every job container, which is what lets the docker workflow
+      # build an image. `valid_volumes` has to allow it explicitly.
+      CONFIG_FILE: /config/config.yaml
+    volumes:
+      - runner-data:/data
+      - ./deploy/act-runner.yaml:/config/config.yaml:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+
+volumes:
+  runner-data: