Align Android signing hardening with gptme: base64 keystore secret, cert pinning, fail-closed #208

gptme/gptme#3409 adopted this repo's signing flow (zipalign + apksigner for APKs, jarsigner for AABs, passwords via env) and hardened it. To keep the two projects on one consistent, battle-tested strategy (cross-referenced in #207), migrate this repo to match:

• Deliver the keystore as a base64-encoded secret (e.g. KEY_ANDROID_JKS_B64) instead of the age-encrypted android.jks.age committed in-repo; drop the age decryption step and adnsio/setup-age-action dependency. Keeps the keystore fully private instead of public-but-encrypted, and removes the extra age identity secret.
• Pin the expected signer certificate SHA-256 as a non-secret repo/environment variable and verify every APK's signer fingerprint (apksigner verify --print-certs) plus jarsigner -verify -strict for AABs before upload.
• Fail closed: release-tag builds should error out when signing secrets are missing, instead of the current Makefile fallback that ships unsigned artifacts ("No key secrets set, not signing"). Non-tag CI builds can keep the unsigned path.
• Consider moving the signing secrets into a GitHub environment for scoping.

Reference implementation: gptme/gptme .github/workflows/tauri.yml (release-android job) and docs/contributing.rst "Android release signing".

Note: the store/key passwords stay the same; only the keystore delivery mechanism changes, so this is a workflow-only migration plus one new secret + one variable.