android: sign release build type from keystore.properties when present

The release build type now applies signingConfigs.release when
android/keystore.properties exists, and stays on the debug-signed
fallback when it is absent, so existing local and CI builds are
unchanged. Also ignore *.jks so signing keys can never be committed.

.gitignore

@@ -6,6 +6,9 @@ android/local.properties
 android/keystore
 android/keystore.asc
 android/keystore.properties
+# Signing keystores: the upload/app-signing keys must NEVER be committed
+*.jks
+android/*.jks
 android/*.apk
 android/*.apk.sha256
 android/*.AppImage

android/app/build.gradle

@@ -46,6 +46,12 @@ android {
         release {
             minifyEnabled false
             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+            // When android/keystore.properties exists the release build signs with
+            // the configured upload key; without it release stays unsigned and the
+            // build falls back to the debug-signed variant (see scripts/android.sh).
+            if (keystorePropertiesFile.exists()) {
+                signingConfig signingConfigs.release
+            }
         }
         if (keystorePropertiesFile.exists()) {
             signedRelease {