Move APK runner to a separate host; openssl-based keystore

- gen-keystore.sh now builds a PKCS12 keystore with openssl (no JDK/keytool),
  and signing.gradle declares storeType PKCS12.
- Runner is meant to run on a roomy server (the app host lacks disk for the
  Android SDK); added runner/README.md with deployment steps. Removed the
  runner that was registered on the app host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/gen-keystore.sh

@@ -1,8 +1,11 @@
 #!/usr/bin/env bash
-# Generate a release signing keystore for the Android APK (run ONCE), then print
-# the base64 + values to paste into Forgejo repo secrets. Keep the keystore file
-# safe and constant forever — losing it or changing it breaks Obtainium updates
-# (a differently-signed APK will not install over the old one).
+# Generate a PKCS12 release signing keystore for the Android APK (run ONCE),
+# using openssl (no JDK/keytool required). Then print the base64 + values to
+# paste into Forgejo repo secrets.
+#
+# Keep the keystore file safe and constant forever — losing it or changing it
+# breaks Obtainium updates (a differently-signed APK won't install over the old
+# one). PKCS12 uses ONE password for both the store and the key.
 set -euo pipefail
 
 KEYSTORE="${1:-campscan-release.keystore}"
@@ -12,17 +15,26 @@ if [ -f "$KEYSTORE" ]; then
   echo "Refusing to overwrite existing $KEYSTORE" >&2
   exit 1
 fi
+command -v openssl >/dev/null || { echo "openssl not found" >&2; exit 1; }
 
 read -r -s -p "Choose a keystore password: " STOREPASS; echo
 read -r -s -p "Confirm keystore password:  " STOREPASS2; echo
 [ "$STOREPASS" = "$STOREPASS2" ] || { echo "Passwords do not match" >&2; exit 1; }
+[ ${#STOREPASS} -ge 6 ] || { echo "Use at least 6 characters" >&2; exit 1; }
 
-keytool -genkeypair -v \
-  -keystore "$KEYSTORE" \
-  -alias "$ALIAS" \
-  -keyalg RSA -keysize 2048 -validity 10000 \
-  -storepass "$STOREPASS" -keypass "$STOREPASS" \
-  -dname "CN=Beartaria Campgrounds, OU=Gate, O=Beartaria, L=, ST=, C=US"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+
+# Self-signed cert + key, valid ~27 years, then bundle into a PKCS12 keystore.
+openssl req -x509 -newkey rsa:2048 -sha256 -days 10000 -nodes \
+  -keyout "$TMP/key.pem" -out "$TMP/cert.pem" \
+  -subj "/CN=Beartaria Campgrounds/OU=Gate/O=Beartaria/C=US" 2>/dev/null
+
+openssl pkcs12 -export \
+  -inkey "$TMP/key.pem" -in "$TMP/cert.pem" \
+  -name "$ALIAS" \
+  -out "$KEYSTORE" \
+  -passout pass:"$STOREPASS"
 
 echo
 echo "==================== Forgejo repo secrets ===================="
@@ -30,7 +42,7 @@ echo "Set these under: git.mowden.top -> CampgroundTickets -> Settings -> Action
 echo
 echo "ANDROID_KEY_ALIAS          = $ALIAS"
 echo "ANDROID_KEYSTORE_PASSWORD  = (the password you just entered)"
-echo "ANDROID_KEY_PASSWORD       = (the same password)"
+echo "ANDROID_KEY_PASSWORD       = (the SAME password — PKCS12 uses one)"
 echo "ANDROID_KEYSTORE_B64       = (paste the block below, single line)"
 echo
 base64 -w0 "$KEYSTORE"; echo