Move APK runner to a separate host; openssl-based keystore

- gen-keystore.sh now builds a PKCS12 keystore with openssl (no JDK/keytool),
  and signing.gradle declares storeType PKCS12.
- Runner is meant to run on a roomy server (the app host lacks disk for the
  Android SDK); added runner/README.md with deployment steps. Removed the
  runner that was registered on the app host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

runner/README.md

@@ -0,0 +1,39 @@
+# Forgejo Actions runner (APK builds)
+
+Run this **on the roomy server** (where Forgejo lives / where there's disk for
+the ~3–4 GB Android SDK), **not** on the app host — the Android build needs
+several GB of scratch space that the small app host doesn't have.
+
+## Deploy
+
+1. Copy this `runner/` directory to the roomy server (or clone the repo there).
+2. In Forgejo → `Beartaria/CampgroundTickets` → **Settings → Actions → Runners → Create new runner**, copy the **registration token**.
+3. Create `.env` from the example and fill it in:
+   ```bash
+   cp .env.example .env
+   # REGISTRATION_TOKEN=<the token from Forgejo>
+   # DOCKER_GID=<output of: stat -c %g /var/run/docker.sock on THIS server>
+   ```
+4. Start it:
+   ```bash
+   mkdir -p data && sudo chown -R 1000:1000 data
+   docker compose up -d
+   docker compose logs -f     # expect "declared successfully" then "poller launched"
+   ```
+
+The runner advertises the `docker` label; the build workflow (`.forgejo/workflows/build-apk.yml`) runs jobs in a `node:22-bookworm` container and installs the Android SDK itself.
+
+## Build an APK
+
+1. One-time: generate a keystore with `../scripts/gen-keystore.sh` and add the four
+   `ANDROID_*` secrets to the repo (see the main README → *APK builds*).
+2. Push a tag: `git tag v0.1.0 && git push origin v0.1.0`.
+3. The runner builds `camp-scan-v0.1.0.apk` and attaches it to a Forgejo release; Obtainium picks it up.
+
+## Notes
+
+- The runner I initially registered on the app host has been removed. If Forgejo
+  still lists an **offline** `camptickets-runner`, delete it from
+  *Settings → Actions → Runners*.
+- `DOCKER_GID` must match the roomy server's docker socket group, or the runner
+  can't reach the Docker daemon.