Align Android signing hardening with gptme: base64 keystore secret, cert pinning, fail-closed

gptme/gptme#3409 adopted this repo's signing flow (zipalign + apksigner for APKs, jarsigner for AABs, passwords via env) and hardened it. To keep the two projects on one consistent, battle-tested strategy (cross-referenced in #207), migrate this repo to match:

- [ ] Deliver the keystore as a base64-encoded secret (e.g. `KEY_ANDROID_JKS_B64`) instead of the age-encrypted `android.jks.age` committed in-repo; drop the age decryption step and `adnsio/setup-age-action` dependency. Keeps the keystore fully private instead of public-but-encrypted, and removes the extra age identity secret.
- [ ] Pin the expected signer certificate SHA-256 as a non-secret repo/environment variable and verify every APK's signer fingerprint (`apksigner verify --print-certs`) plus `jarsigner -verify -strict` for AABs before upload.
- [ ] Fail closed: release-tag builds should error out when signing secrets are missing, instead of the current Makefile fallback that ships unsigned artifacts ("No key secrets set, not signing"). Non-tag CI builds can keep the unsigned path.
- [ ] Consider moving the signing secrets into a GitHub environment for scoping.

Reference implementation: gptme/gptme `.github/workflows/tauri.yml` (release-android job) and `docs/contributing.rst` "Android release signing".

Note: the store/key passwords stay the same; only the keystore delivery mechanism changes, so this is a workflow-only migration plus one new secret + one variable.