CI: upload APK to the Forgejo release via API instead of forgejo-release action

The build succeeds but publishing failed with "$FORGEJO_PATH: ambiguous
redirect" — the moving actions/forgejo-release@v2 tag updated to a broken
version. Replace it with direct Forgejo API calls (create release, delete any
prior same-named asset, upload the APK) using the built-in token, so the last
step is under our control.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build-apk.yml

@@ -139,14 +139,30 @@ jobs:
           cp app/build/outputs/apk/release/app-release.apk \
              "$GITHUB_WORKSPACE/artifacts/camp-scan-${{ steps.ver.outputs.tag }}.apk"
 
-      - name: Publish Forgejo release with APK
-        uses: actions/forgejo-release@v2
-        with:
-          direction: upload
-          url: https://git.mowden.top
-          repo: Beartaria/CampgroundTickets
-          tag: ${{ steps.ver.outputs.tag }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-          release-dir: artifacts
-          release-notes: "Camp Scan ${{ steps.ver.outputs.tag }} — install/update via Obtainium."
-          override: true
+      - name: Publish APK to Forgejo release
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.ver.outputs.tag }}
+        run: |
+          set -eu
+          API="https://git.mowden.top/api/v1/repos/Beartaria/CampgroundTickets"
+          APK="$GITHUB_WORKSPACE/artifacts/camp-scan-${TAG}.apk"
+          AUTH="Authorization: token ${TOKEN}"
+          # Create the release for this tag (ignore failure if it already exists).
+          curl -sS -X POST "$API/releases" -H "$AUTH" -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"${TAG}\",\"name\":\"Camp Scan ${TAG}\",\"body\":\"Install/update via Obtainium.\"}" \
+            -o /dev/null -w "create release: %{http_code}\n" || true
+          # Look up the release id by tag.
+          REL_ID=$(curl -sS "$API/releases/tags/${TAG}" -H "$AUTH" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*')
+          echo "release id: ${REL_ID}"
+          test -n "$REL_ID"
+          # Remove a same-named asset from a prior run, then upload the APK.
+          EXISTING=$(curl -sS "$API/releases/${REL_ID}/assets" -H "$AUTH" \
+            | tr '}' '\n' | grep -F "camp-scan-${TAG}.apk" | grep -o '"id":[0-9]*' | head -1 | grep -o '[0-9]*' || true)
+          if [ -n "${EXISTING:-}" ]; then
+            curl -sS -X DELETE "$API/releases/${REL_ID}/assets/${EXISTING}" -H "$AUTH" -o /dev/null -w "delete old asset: %{http_code}\n"
+          fi
+          curl -sS -f -X POST "$API/releases/${REL_ID}/assets?name=camp-scan-${TAG}.apk" \
+            -H "$AUTH" -F "attachment=@${APK};type=application/vnd.android.package-archive" \
+            -o /dev/null -w "upload apk: %{http_code}\n"
+          echo "Published camp-scan-${TAG}.apk"