Release signing fix + Obtainium install guide + publish script

- Fix withReleaseSigning: RN template's unconditional debug signingConfig was
  overriding the release key. Now uses the release key when BBP_UPLOAD_* is set
  (verified: APK signed CN=BigBrainParking), else debug.
- INSTALL.md: dead-simple Obtainium setup (one-tap obtainium:// link + manual
  Forgejo-source steps). README links it.
- scripts/publish-release.sh: create a Forgejo release + upload the signed APK.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/plugins/withReleaseSigning.js

@@ -33,10 +33,12 @@ module.exports = function withReleaseSigning(config) {
         /signingConfigs \{/,
         `signingConfigs {${SIGNING_BLOCK}`,
       );
-      // 2) Point the release buildType at it *only* when the keystore env is set.
+      // 2) Point the release buildType at the release key when its env is set, else
+      //    debug. Replace the RN template's unconditional debug line inside the
+      //    release {} block (otherwise it overrides the release config).
       gradle = gradle.replace(
-        /(buildTypes \{[\s\S]*?release \{)/,
-        `$1\n            if (System.getenv("BBP_UPLOAD_STORE_FILE") != null) { signingConfig signingConfigs.release }`,
+        /(release \{[\s\S]*?)signingConfig signingConfigs\.debug/,
+        `$1signingConfig System.getenv("BBP_UPLOAD_STORE_FILE") != null ? signingConfigs.release : signingConfigs.debug`,
       );
     }