mobile: build Google Play bundles and publish on demand

[aojea]

Release builds of SAM Connect were signed with the debug key, which Google Play rejects, and the only CI path was an APK baked into the goreleaser workflow. This wires up a Play-ready bundle, splits the mobile build into its own workflow, and adds on-demand publishing.

Signing and bundle

• android/app/build.gradle.kts: release builds sign with an upload key from android/key.properties (Flutter's standard layout) or ANDROID_KEYSTORE_PATH / ANDROID_KEYSTORE_PASSWORD / ANDROID_KEY_ALIAS / ANDROID_KEY_PASSWORD. With neither present it falls back to the debug key with a warning, so flutter run --release and local APKs are unaffected.
• make mobile-app-bundle runs flutter build appbundle --release and fails fast, pointing at the docs, when no upload key is configured. MOBILE_BUILD_NAME / MOBILE_BUILD_NUMBER override the pubspec version so Play always sees a fresh versionCode.
• The duplicated google-services.json and libsam.so copy steps are factored into mobile-app-google-services and mobile-app-jnilibs-arm64, shared by all three app targets.

CI

• New Mobile App workflow (.github/workflows/mobile.yml):
  • on v* tags, runs in parallel with goreleaser; the attach-to-release job waits for goreleaser to create the release, then uploads the APK and .aab;
  • on workflow_dispatch from any ref, with a track input (none = build only; internal / alpha / beta / production publish) and an optional build_number override. APK and .aab are always available as run artifacts.
  • publish mints a short-lived androidpublisher access token through Workload Identity Federation (repo vars WIF_PROVIDER_NAME_APP_STORE / SERVICE_ACCOUNT_EMAIL_APP_STORE) and runs hack/publish-play.sh, which drives the Play Developer Publishing API (edit → upload → track → commit) with curl + jq. The token reaches curl via a 0600 header file, never argv. No long-lived service-account key is stored.
• release.yml is pure goreleaser again; the Java/NDK/Flutter setup and the "restore files rewritten by Flutter" workaround go with the mobile steps.

Housekeeping

• Root .gitignore now ignores *.jks, *.keystore, key.properties and google-services.json repo-wide (the tracked .tmpl is unaffected).
• mobile/sam-node-app/README.md gains a "Publishing to Google Play" section: creating the upload key, key.properties, the make target, the workflow triggers and the Play Console / WIF prerequisites.

Verification

• make -n for all mobile targets; bash -n and argument-validation runs of hack/publish-play.sh; YAML parses. No Flutter/JDK/NDK on the dev box, so the first real build is the CI run of this branch.
• Repository secrets (ANDROID_KEYSTORE_*, ANDROID_KEY_*, GOOGLE_SERVICES_JSON_BASE64) and the *_APP_STORE variables are already set on google/sam.

[gemini-code-assist]

Code Review

This pull request introduces support for building and publishing Android App Bundles (AAB) to Google Play. Key changes include a new mobile-app-bundle Makefile target, a publish-play.sh script for automated releases, and updated Gradle configuration to support secure release signing via environment variables or key.properties. The review feedback provides actionable improvements for robust error handling in the build and publishing scripts, as well as safer Gradle configuration practices.