Add a custom Android CI/release build image and packaging scripts

- build-image/: Dockerfile bundling JDK 17, the Android SDK, and
  Node.js (needed by Gitea's JS-based actions) - the app has no
  native code, so no NDK
- build-image.sh/upload-image.sh: extended to also build/push this
  image alongside the existing OCR pipeline tools image
- run-image.sh: runs `make android` inside the image against a live
  checkout, for a CI-equivalent local build
- Makefile: `make android` builds and versions a release APK into
  dist/, from the current git tag
- .gitea/workflows/build.yml: now pulls the custom image and just
  runs `make android`, replacing the ad-hoc Node/SDK install steps
- README.md: describes the pipeline, server, app, and build tooling
- registry.env.example: fix REGISTRY_IMAGE to be fully-qualified
  (an unqualified name was silently resolving pushes to Docker Hub
  instead of the configured registry)

.gitea/workflows/build.yml

@@ -1,10 +1,13 @@
 name: build
 
 # Builds the Android app (android/) debug APK on every push/PR, plus
-# on-demand via the Gitea "Run workflow" button. Runs inside a public,
-# prebuilt Android CI image (JDK + Android SDK/cmdline-tools bundled -
-# fuelish's app has no native/NDK code, so it doesn't need a custom
-# builder image the way a project with native components would).
+# on-demand via the Gitea "Run workflow" button. Runs inside build-image
+# (see ../../build-image/Dockerfile, built/pushed via ../../build-image.sh
+# and ../../upload-image.sh), which bundles the JDK, Android SDK, and
+# Node.js (needed by the JS-based actions below - see
+# build-image/Dockerfile's own comment) so the runner itself doesn't need
+# any of that installed. The Gradle build still needs network access at
+# job runtime (Gradle/AGP/androidx dependency resolution).
 on:
   push:
   pull_request:
@@ -21,52 +24,28 @@ jobs:
     runs-on: ubuntu-latest
 
     container:
-      # JDK + Android SDK cmdline-tools, no platform/build-tools installed -
-      # the "Install SDK components" step below fetches exactly what
-      # compileSdk in android/app/build.gradle.kts needs. Much smaller than
-      # kitchen-sink alternatives (~0.7GB vs. several GB), which matters
-      # since every job pulls it fresh.
-      image: thyrlian/android-sdk:10.0
+      image: cr.ladkau.de/fuelish/android-builder:latest
+      credentials:
+        username: ${{ secrets.REGISTRY_USER }}
+        password: ${{ secrets.REGISTRY_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
         with:
-          # APK naming below uses `git rev-parse --short HEAD` - harmless
-          # with the default shallow clone, but fetch-depth: 0 keeps this
-          # consistent if that ever switches to `git describe --tags`.
+          # `make android`'s version comes from `git describe --tags` -
+          # needs full history/tags, not actions/checkout's default
+          # shallow single-commit clone.
           fetch-depth: 0
 
       - name: Preflight
         run: |
           set -euo pipefail
           command -v java >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: java not in PATH" >&2; exit 1; }
+          command -v make >/dev/null 2>&1 || { echo "PREFLIGHT FAIL: make not in PATH" >&2; exit 1; }
           [ -n "${ANDROID_HOME:-}" ] || { echo "PREFLIGHT FAIL: ANDROID_HOME not set" >&2; exit 1; }
-          [ -x android/gradlew ] || { echo "PREFLIGHT FAIL: android/gradlew missing or not executable" >&2; exit 1; }
-
-      - name: Install SDK components
-        run: |
-          set -euo pipefail
-          # python3-pil: android/scripts/gen_app_icons.py's Pillow dependency
-          # (see android/app/build.gradle.kts's generateAppIcons preBuild task)
-          # - not bundled in this image.
-          apt-get update -qq
-          apt-get install -y --no-install-recommends python3-pil
-          yes | sdkmanager --licenses >/dev/null 2>&1 || true
-          # Keep in sync with android/app/build.gradle.kts's compileSdk.
-          sdkmanager "platforms;android-36" "build-tools;36.0.0"
 
       - name: Build
-        working-directory: android
-        run: ./gradlew :app:assembleDebug --console=plain
-
-      - name: Package
-        # Renames the debug APK with the commit it was built from, so
-        # multiple builds in dist/ (and on dl.ladkau.de) don't collide.
-        run: |
-          set -euo pipefail
-          mkdir -p dist
-          sha="$(git rev-parse --short HEAD)"
-          cp android/app/build/outputs/apk/debug/app-debug.apk "dist/fuelish-$sha.apk"
+        run: make android
 
       - name: Upload build artifact
         # v4 uses the newer @actions/artifact backend, which this Gitea