Publish AAR to Maven Central as com.perryts:play-billing-bridge

[proggeramlug]

Today (v0.1.x) the precompiled AAR is committed to this repo and shipped inside the npm tarball. Host APKs consume it with:

```kotlin
dependencies {
implementation(files("../../node_modules/@perryts/play-billing/android/play-billing-bridge.aar"))
implementation("com.android.billingclient:billing-ktx:7.1.1")
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.8.1")
}
```

The two extra `implementation` lines exist because a `files(...)` Gradle dependency carries no POM metadata, so transitive deps don't resolve.

Goal

Publish the AAR to Maven Central as `com.perryts:play-billing-bridge` so the host APK shrinks to:

```kotlin
dependencies {
implementation("com.perryts:play-billing-bridge:0.2.0")
}
```

`billing-ktx` and `kotlinx-coroutines-android` get pulled in transitively from the published POM.

Work

• Set up Sonatype/Maven Central account on the `com.perryts` namespace (DNS verification of `perryts.dev` or similar).
• Configure `maven-publish` + `signing` Gradle plugins in `android/build.gradle.kts`.
• Sigstore / GPG signing key managed via GitHub Actions OIDC trusted publishing (Sonatype's new central-publishing-maven-plugin supports this without long-lived secrets — same idea as the npm trusted publisher we already use).
• Add an `android-publish.yml` workflow that fires on the same release event as the npm publish workflow but pushes the AAR to Maven Central.
• Update README to drop the `files(...)` recipe and the transitive-deps bullet point.
• Bump to 0.2.0 — Maven Central deprecates dependency mismatches between groupId/version on the npm package and the AAR, so they should move in lockstep.

Why deferred

Maven Central trusted publishing infrastructure is a meaningful one-time setup (DNS verification, Sonatype account approval, plugin wiring). The `files(...)` recipe in v0.1.x lets us ship a working binding today. This issue tracks the polish.