K2GO-433 ci(release): build and archive the Play AAB

Build bundlePlayRelease in the release workflow (signed with the injected
keystore), upload the signed AAB as a workflow artifact for the manual Play
Console upload, and archive a historical copy to R2 (one object per release,
keyed by the versioned filename). The AAB is not added to GitHub Releases: it is
a publishing format, not a directly installable APK.

Author: luisguzman-adfa

.github/workflows/android-release-build.yml

@@ -77,7 +77,10 @@ jobs:
           # In-APK traceability is unaffected: BuildConfig.GIT_SHA still records the commit.
           # K2GO-431: build both flavors. standard -> GitHub + R2 + OTA update.json (as before);
           # fdroid -> R2 only (F-Droid distributes it; it carries no in-app OTA).
-          ./gradlew assembleStandardRelease assembleFdroidRelease \
+          # K2GO-433: also build the Play AAB (play flavor). It is uploaded as a workflow artifact for
+          # the manual Play Console upload and archived to R2, but not to GitHub Releases: an AAB is a
+          # publishing format, not a directly installable APK.
+          ./gradlew assembleStandardRelease assembleFdroidRelease bundlePlayRelease \
             -PversionSuffix="" \
             -Pandroid.injected.signing.store.file=$(pwd)/keystore.jks \
             -Pandroid.injected.signing.store.password=$KEYSTORE_PASSWORD \
@@ -91,6 +94,15 @@ jobs:
           path: controller/**/build/outputs/apk/*/release/*.apk
           retention-days: 7
 
+      # K2GO-433: the signed Play AAB, for the manual Play Console upload (automated Play Developer API
+      # publishing is a future follow-up once the app is live on Play).
+      - name: Upload Play AAB Artifact
+        uses: actions/upload-artifact@v6
+        with:
+          name: k2go-play-aab
+          path: controller/app/build/outputs/bundle/playRelease/*.aab
+          retention-days: 7
+
       # --- GITHUB RELEASES ---
 
       - name: Create GitHub Release
@@ -128,6 +140,17 @@ jobs:
               --content-type "application/vnd.android.package-archive"
           done
 
+          # K2GO-433: archive a historical copy of the Play AAB to R2 too (one object per release, keyed
+          # by its versioned filename). An AAB is a publishing format (not installable), so this is an
+          # archive / audit copy of exactly what we upload to Play; the Play Console upload stays manual.
+          for aab in $(find . -path "*/build/outputs/bundle/playRelease/*.aab"); do
+            filename=$(basename "$aab")
+            echo "Uploading $filename to Cloudflare R2 ($BUCKET_NAME)..."
+            aws s3 cp "$aab" "s3://$BUCKET_NAME/$filename" \
+              --endpoint-url "https://${R2_ACCOUNT_ID}.r2.cloudflarestorage.com" \
+              --content-type "application/octet-stream"
+          done
+
       # --- OTA MANIFEST (update.json) ---
       # ADFA-4984: publish the OTA manifest LAST, after the APKs are already in R2, so it never
       # points at a missing binary. update.json is a fixed key -> it overwrites the previous manifest