fix(android): sign release APK with a stable keystore in CI

Release builds were signed with the debug keystore. On the GitHub runner
that keystore is generated fresh on every build, so each CI APK carried a
different signature and Android refused to install it over an existing
version ("App not installed").

- build.gradle.kts: read android/key.properties when present and use it
  as the release signing config; fall back to debug otherwise so local
  `flutter run --release` keeps working.
- build-apk.yml: decode the keystore from ANDROID_KEYSTORE_* secrets into
  android/key.properties before building, and fail early if any secret
  is missing instead of silently signing with a throwaway key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3E5JovvDaQQ19D4UR258o

.github/workflows/build-apk.yml

@@ -37,6 +37,30 @@ jobs:
 
       - run: flutter pub get
 
+      # Keystore fixe injecté via secrets : sans lui, Gradle signerait avec une
+      # clé debug générée sur le runner (différente à chaque build) et l'APK ne
+      # s'installerait pas par-dessus une version déjà présente sur l'appareil.
+      - name: Set up release signing
+        env:
+          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          for v in KEYSTORE_BASE64 KEYSTORE_PASSWORD KEY_ALIAS KEY_PASSWORD; do
+            if [ -z "${!v}" ]; then
+              echo "::error::Secret ANDROID_$v manquant — impossible de signer l'APK avec une clé stable."
+              exit 1
+            fi
+          done
+          echo "$KEYSTORE_BASE64" | base64 -d > android/app/release.jks
+          {
+            echo "storeFile=release.jks"
+            echo "storePassword=$KEYSTORE_PASSWORD"
+            echo "keyAlias=$KEY_ALIAS"
+            echo "keyPassword=$KEY_PASSWORD"
+          } > android/key.properties
+
       - name: Build release APK
         run: flutter build apk --release