CI: cap runner parallelism; play success chime immediately on scan

CI: limit Gradle to 2 worker JVMs (org.gradle.workers.max=2, --max-workers=2,
parallel=false), cap native compiler jobs (CMAKE_BUILD_PARALLEL_LEVEL=2), and
build only the arm64-v8a ABI — so the build no longer spawns a JVM/compiler per
core and swamps the host (which also serves Forgejo).

App: the success chime now fires the instant a scan resolves to a valid ticket
(ticket/ice modes), matching Banquet, instead of after the check-in round-trip.
The failure sound is unchanged. Removed the duplicate chime at check-in.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/build-apk.yml

@@ -28,10 +28,18 @@ jobs:
       # The runner host has no working IPv6 route, so Maven Central (which has
       # AAAA records) was unreachable — this makes Java ignore AAAA and use IPv4.
       JAVA_TOOL_OPTIONS: -Djava.net.preferIPv4Stack=true
-      # org.gradle.caching enables the local build cache (persisted in
-      # GRADLE_USER_HOME), so unchanged native/Kotlin tasks are restored instead
-      # of recompiled.
-      GRADLE_OPTS: -Dorg.gradle.jvmargs=-Xmx4g -Dorg.gradle.daemon=false -Dorg.gradle.caching=true
+      # Keep the build from swamping the host:
+      #  - workers.max=2: at most 2 concurrent Gradle worker JVMs (was one per core)
+      #  - parallel=false: don't build projects in parallel
+      #  - caching=true: reuse the local build cache (persisted in GRADLE_USER_HOME)
+      GRADLE_OPTS: >-
+        -Dorg.gradle.jvmargs=-Xmx3g
+        -Dorg.gradle.daemon=false
+        -Dorg.gradle.caching=true
+        -Dorg.gradle.parallel=false
+        -Dorg.gradle.workers.max=2
+      # Cap the C/C++ (ninja) compiler jobs per native-build task to 2.
+      CMAKE_BUILD_PARALLEL_LEVEL: "2"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -95,7 +103,13 @@ jobs:
           CAMPSCAN_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
           chmod +x ./gradlew
-          ./gradlew assembleRelease --init-script ../../ci/signing.gradle --no-daemon --build-cache
+          # Build a single ABI (arm64-v8a covers all modern phones) to cut native
+          # compilation ~4x and keep the host load down. --max-workers=2 bounds
+          # concurrent tasks on top of the workers.max setting.
+          ./gradlew assembleRelease \
+            --init-script ../../ci/signing.gradle \
+            --no-daemon --build-cache --max-workers=2 \
+            -PreactNativeArchitectures=arm64-v8a
           mkdir -p "$GITHUB_WORKSPACE/artifacts"
           cp app/build/outputs/apk/release/app-release.apk \
              "$GITHUB_WORKSPACE/artifacts/camp-scan-${{ steps.ver.outputs.tag }}.apk"