ci: sign with the EAS-managed keystore (new alias + separate key password)

Requires updated repo secrets KEYSTORE_B64, KEYSTORE_PASSWORD, KEY_PASSWORD.
Until they are set, CI release builds fail instead of shipping an APK signed
with the old key that Obtainium would reject.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YE5FmDZmFnWxH6RXCZLcjj

.gitignore

@@ -5,3 +5,5 @@ server/.env
 server/.env.token.local
 *.log
 .DS_Store
+credentials.json
+*.jks