ci: Android multi-ABI APK pipeline + pydantic-core wheel rebuild

Adds .gitea/workflows/build-android.yml — Linux runner installs JDK 17,
Python 3.11, Android SDK/NDK, symlinks server/src/ledgrab into the
Chaquopy python source dir, and runs assembleDebug on master pushes /
assembleRelease on v* tags. APK is uploaded as an artifact and attached
to the Gitea release on tag push. Conditional signing config in
build.gradle.kts reads keystore from env vars (CI secrets) and falls
back to debug signing locally. Gradle wrapper (gradlew/gradlew.bat/
gradle-wrapper.jar) committed so CI can drive the build.

Rebuilds pydantic-core wheels for arm64-v8a and x86_64 — both were
missing libpython3.11.so in NEEDED, which would have crashed at import
on real devices. build-pydantic-core.sh rewritten as a multi-ABI builder:
selects targets via args, sets RUSTFLAGS=-C link-arg=-Wl,--no-as-needed
-C link-arg=-lpython3.11 to force the symbol-resolution dependency,
uses the per-ABI sysconfigdata + libpython staged in
android/.build-cache/, prefers `py -3.11` on Windows (Git Bash's
python3.11 is an MSStore stub), uses the .cmd clang wrapper on Windows
(fixes os error 193), and verifies NEEDED via llvm-readelf after each
build. abiFilters restored to the full triple in build.gradle.kts;
multi-ABI debug APK builds cleanly (~99 MB).

TODO.md

@@ -4,13 +4,10 @@
 
 During emulator testing, we switched the build to **x86 only** (see `android/app/build.gradle.kts` `abiFilters`) to avoid having to keep the arm64-v8a / x86_64 pydantic-core wheels current. Before shipping, restore all three ABIs:
 
-- [ ] Rebuild `pydantic-core` wheels for all three ABIs with the current SOABI + libpython linking settings:
-  - `arm64-v8a` (real TV boxes — the primary target)
-  - `x86_64` (modern emulators)
-  - `x86` (legacy emulators)
-- [ ] Verify wheels with `readelf -d`: SONAME must be `libpython3.11.so` in NEEDED
-- [ ] Restore `abiFilters += listOf("arm64-v8a", "x86_64", "x86")` in `build.gradle.kts`
-- [ ] Re-test on real ARM64 Android TV hardware
+- [x] Rebuild `pydantic-core` wheels for all three ABIs with the current SOABI + libpython linking settings (`android/build-scripts/build-pydantic-core.sh` — now supports `arm64`, `x86_64`, `x86` args; defaults to all three).
+- [x] Verify wheels: all three now list `libpython3.11.so` in `NEEDED` (`llvm-readelf -d`), automated in the build script.
+- [x] Restored `abiFilters += listOf("arm64-v8a", "x86_64", "x86")` in `build.gradle.kts`. Multi-ABI debug APK builds cleanly (~99 MB).
+- [ ] Re-test on real ARM64 Android TV hardware (still pending — only emulator-verified build).
 
 Build cache + scripts live in `android/build-scripts/` and `android/.build-cache/` (junction host + sysconfigdata for each ABI).
 
@@ -18,16 +15,22 @@ Build cache + scripts live in `android/build-scripts/` and `android/.build-cache
 
 Build the Android APK automatically on push/tag.
 
-- [ ] Generate Gradle wrapper (`gradlew`) and commit it
-- [ ] Create CI workflow (`.gitea/workflows/build-android.yaml` or `.github/workflows/`)
+- [x] Generate Gradle wrapper (`gradlew`) and commit it
+- [x] Create CI workflow (`.gitea/workflows/build-android.yml`)
   - JDK 17 + Android SDK + NDK setup
   - Python 3.11 for Chaquopy build
-  - Recreate the directory junction (`ln -s` on Linux, `mklink /J` on Windows)
-  - `./gradlew assembleRelease`
-  - Upload APK as artifact
-- [ ] Commit pre-built pydantic-core wheels to `android/wheels/` (arm64, x86, x86_64)
-- [ ] APK signing for release builds (keystore setup)
-- [ ] Consider: publish APK to GitHub/Gitea releases on tag push
+  - Recreate the directory junction via `ln -s` on Linux CI
+  - `./gradlew assembleDebug` on master push, `assembleRelease` on `v*` tags (if signing secrets set)
+  - Uploads APK as CI artifact; attaches to Gitea release on tag push
+- [x] Commit pre-built pydantic-core wheels to `android/wheels/` (arm64, x86, x86_64)
+- [x] APK signing for release builds — conditional signing config reads keystore from env vars (`ANDROID_KEYSTORE_PATH/_PASSWORD/_ALIAS/_KEY_PASSWORD`), falls back to debug signing locally
+- [ ] Provision a real keystore and add the four CI secrets:
+  - `ANDROID_KEYSTORE_BASE64` (base64-encoded .jks)
+  - `ANDROID_KEYSTORE_PASSWORD`
+  - `ANDROID_KEY_ALIAS`
+  - `ANDROID_KEY_PASSWORD`
+- [ ] Add `LedGrab-{tag}-android-release.apk` row to the release description table in `.gitea/workflows/release.yml` → `create-release` job
+- [ ] Verify the CI workflow passes end-to-end with the now-restored multi-ABI build (larger APK, longer Android build step)
 
 ## Android Root Capture (No Permission Dialog, No System Indicator)