ci: sign with the EAS-managed keystore (new alias + separate key password)

Requires updated repo secrets KEYSTORE_B64, KEYSTORE_PASSWORD, KEY_PASSWORD.
Until they are set, CI release builds fail instead of shipping an APK signed
with the old key that Obtainium would reject.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YE5FmDZmFnWxH6RXCZLcjj

.gitea/workflows/release.yml

@@ -83,7 +83,10 @@ jobs:
         env:
           KEYSTORE_FILE: /tmp/release.jks
           KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
-          KEY_ALIAS: gtd
+          # EAS-managed keystore (since v1.16) — alias is EAS-generated, and the
+          # key password can differ from the store password.
+          KEY_ALIAS: a5ff13aa8571055bcaecbaca29a548ae
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
           VERSION_CODE: ${{ github.run_number }}
           VERSION_NAME: 1.${{ github.run_number }}
         run: |

.gitignore

@@ -5,3 +5,5 @@ server/.env
 server/.env.token.local
 *.log
 .DS_Store
+credentials.json
+*.jks