ci(android): fix missing python symlink parent, restrict to release tags

- Create android/app/src/main/python before `ln -sfn` — the parent dir
  isn't committed (android/.gitignore:17 ignores /ledgrab inside it) so
  fresh CI checkouts had nothing to link into, failing with
  "No such file or directory".
- Also wrap the step with `set -euo pipefail` and a `test -d` check so a
  broken link aborts the job instead of producing a silently-empty APK.
- Drop the `branches: [master]` push trigger and the `paths:` filter —
  every master commit touching android/** or server/src/ledgrab/** was
  queueing a ~100 MB APK build that nobody used. Only tag pushes (v*)
  and workflow_dispatch remain.

.gitea/workflows/build-android.yml

@@ -1,13 +1,11 @@
 name: Build Android APK
 
 on:
+  # Release tags only — building the ~100 MB APK on every master push
+  # burned Gitea runner minutes without producing a useful artifact.
+  # Use workflow_dispatch for on-demand dev builds.
   push:
-    branches: [master]
     tags: ['v*']
-    paths:
-      - 'android/**'
-      - 'server/src/ledgrab/**'
-      - '.gitea/workflows/build-android.yml'
   workflow_dispatch:
     inputs:
       version:
@@ -97,10 +95,16 @@ jobs:
 
       - name: Link Python source (junction equivalent)
         run: |
+          set -euo pipefail
           # Chaquopy reads Python modules from android/app/src/main/python/
-          # On Windows dev machines this is a directory junction; on Linux CI use a symlink.
+          # On Windows dev machines this is a directory junction; on Linux
+          # CI use a symlink. The parent dir is .gitignore'd (the junction
+          # target is the real content), so we have to create it first.
+          mkdir -p android/app/src/main/python
           ln -sfn "$(pwd)/server/src/ledgrab" android/app/src/main/python/ledgrab
           ls -la android/app/src/main/python/
+          # Sanity check — readlink resolves the link and the directory exists.
+          test -d android/app/src/main/python/ledgrab
 
       - name: Decode signing keystore
         id: keystore