feat: store release setup — EAS config, listing copy, screenshots, new icon

- eas.json production/simulator profiles; iOS plist flags; EAS project linked
- literal versionCode/versionName in build.gradle so EAS can parse it; Gitea CI
  stamps the run number with sed instead of env-driven gradle expressions
- store/: listing copy + keyword rationale, screenshot composer (headless
  Chrome), raw simulator captures, rendered App Store / Play slides, feature
  graphic, privacy policy source, icon generator
- replace Expo placeholder icon with the session-ring mark; regenerate Android
  launcher/splash res and theme colours

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WontRuPqKcod9XK4ZN9MXv

README.md

@@ -38,8 +38,37 @@ npm test             # node --test over src/lib/*.test.ts
 
 ## Release
 
-Push to `main` → Gitea Actions on the desktop runner (`runs-on: desktop`,
-never the VPS) builds a signed APK and publishes a Gitea release — install via
-Obtainium. Keystore: `~/.android-keys/kegel-release.jks` (repo secrets
-`KEYSTORE_B64`, `KEYSTORE_PASSWORD`; alias `kegel`). iOS runs via
-`npx expo run:ios` from a Mac.
+### Android APK (Gitea / Obtainium)
+
+Push to `main` → Gitea Actions builds a signed APK and publishes a Gitea
+release — install via Obtainium. `android/app/build.gradle` keeps literal
+`versionCode`/`versionName`; CI stamps the run number in with `sed` before
+building. Keystore: `~/.android-keys/kegel-release.jks` (repo secrets
+`KEYSTORE_B64`, `KEYSTORE_PASSWORD`; alias `kegel`). Beware: `expo prebuild -p android`
+(used to regenerate launcher icons from `store/icons/make.js`) rewrites
+`build.gradle` and drops the release `signingConfigs` block — restore it from git.
+
+### App Store / Google Play (EAS)
+
+Store builds run on EAS (project `@mrmen23/kegel`, profile `production`,
+version source remote with auto-increment). The EAS-managed Android keystore
+differs from the Gitea one, so Play and Obtainium installs can't update over
+each other.
+
+```sh
+# Apple: needs an App Store Connect API key for non-interactive auth
+export EXPO_ASC_API_KEY_PATH=~/Downloads/AuthKey_L9Z6F5H5B7.p8 EXPO_ASC_KEY_ID=L9Z6F5H5B7 \
+       EXPO_ASC_ISSUER_ID=<issuer uuid> EXPO_APPLE_TEAM_ID=HZ6XCKM95R EXPO_APPLE_TEAM_TYPE=INDIVIDUAL
+eas build -p ios --profile production --non-interactive
+eas submit -p ios --profile production --latest --non-interactive   # creates the ASC record on first run
+
+# Android: needs a Play service-account JSON with release access
+eas build -p android --profile production --non-interactive
+eas submit -p android --profile production --latest --key <service-account.json> --track internal
+```
+
+Listing copy, keyword rationale and screenshot generation live in `store/`
+(`node store/screenshots/make.js` renders `store/screenshots/raw/*.png` into
+store-sized slides). Privacy policy is served from
+https://rehbock.xyz/kegel/privacy.html (source in `store/web/`). iOS dev runs
+via `npx expo run:ios` from a Mac.