Add a custom Android CI/release build image and packaging scripts

- build-image/: Dockerfile bundling JDK 17, the Android SDK, and
  Node.js (needed by Gitea's JS-based actions) - the app has no
  native code, so no NDK
- build-image.sh/upload-image.sh: extended to also build/push this
  image alongside the existing OCR pipeline tools image
- run-image.sh: runs `make android` inside the image against a live
  checkout, for a CI-equivalent local build
- Makefile: `make android` builds and versions a release APK into
  dist/, from the current git tag
- .gitea/workflows/build.yml: now pulls the custom image and just
  runs `make android`, replacing the ad-hoc Node/SDK install steps
- README.md: describes the pipeline, server, app, and build tooling
- registry.env.example: fix REGISTRY_IMAGE to be fully-qualified
  (an unqualified name was silently resolving pushes to Docker Hub
  instead of the configured registry)

registry.env.example

@@ -1,9 +1,19 @@
 # Copy to registry.env (gitignored, never commit the real values) and fill
-# in your registry credentials. Used by build-image.sh, the numbered
-# pipeline scripts, and upload-image.sh. Only REGISTRY_IMAGE is needed for
-# local builds/runs; REGISTRY/REGISTRY_USER/REGISTRY_PASSWORD are only
-# needed to push with upload-image.sh.
-REGISTRY=
-REGISTRY_IMAGE=fuelish/tools
+# in your registry credentials. Used by build-image.sh, upload-image.sh,
+# run-image.sh, and the numbered pipeline scripts.
+#
+# REGISTRY_IMAGE (the OCR pipeline's tools image, tooling-container/) and
+# REGISTRY_ANDROID_IMAGE (the Android CI/release build image,
+# build-image/) must both be fully-qualified with the registry host -
+# upload-image.sh does `docker push "$REGISTRY_IMAGE:..."` directly, so
+# an unqualified name (e.g. "fuelish/tools") silently resolves to Docker
+# Hub instead of $REGISTRY and fails to push there ("insufficient_scope:
+# authorization failed") even though `docker login "$REGISTRY"`
+# succeeded. Adjust the host below if your registry isn't cr.ladkau.de.
+# REGISTRY/REGISTRY_USER/REGISTRY_PASSWORD are only needed to push with
+# upload-image.sh.
+REGISTRY=cr.ladkau.de
+REGISTRY_IMAGE=cr.ladkau.de/fuelish/tools
+REGISTRY_ANDROID_IMAGE=cr.ladkau.de/fuelish/android-builder
 REGISTRY_USER=
 REGISTRY_PASSWORD=