Register the release SHA at publish time

1. Create an upload key (once, keep forever, never commit)

keytool -genkeypair -v -keystore livia-upload.jks -alias upload -keyalg RSA -keysize 2048 -validity 10000

Store it outside the repo (or rely on the existing *.jks ignore rule). Back it up.
Losing it means a key reset request through Play support.

2. Add a release signing config

app/build.gradle.kts has no signingConfig yet. Add one that reads the keystore
path, alias and passwords from a git-ignored key.properties.

3. Build and upload a bundle to Play Console (internal testing track)

./gradlew bundleRelease

Upload app/build/outputs/bundle/release/app-release.aab. Play App Signing is on by
default for new apps, so Google generates the app signing key at this point. The
release can stay a draft; publishing is not required.

4. Copy the app signing key fingerprint

Play Console → Release → Setup → App signing. Take the SHA-256 from the
"App signing key certificate" section (not the upload key one).

5. Register it in Firebase

Firebase console → Project settings → General → Android app io.deepiks.livia →
"Add fingerprint". Keep the debug fingerprint alongside it.

Then download the refreshed google-services.json and replace
app/google-services.json (the file changes when fingerprints are added).

6. Turn on App Check enforcement

Firebase console → App Check. Enable enforcement only after a Play-installed build
is confirmed to receive tokens. Enforcing earlier locks out every client.

7. Verify with a Play-delivered build

Install through the internal testing link, not by sideloading, and watch logcat for
App Check errors. A sideloaded release APK is signed by the upload key, not the app
signing key, so it will not pass Play Integrity.

Reminder

The backend still expects the old X-Attestation-* headers. Step 7 will 401 until
the server verifies Firebase ID tokens and App Check tokens.

Reference: fingerprints already known

Debug key on this Mac (~/.android/debug.keystore, alias androiddebugkey, password android):

SHA-1:   00:DB:FB:11:AE:13:1F:C1:C6:1F:53:2E:A1:16:44:F5:0C:75:45:EC
SHA-256: 6C:83:91:A2:C3:CF:AB:FF:FD:9B:37:1A:C7:1D:64:6C:2A:36:55:DC:2A:C5:F6:BC:CA:77:B8:94:7F:69:98:AF

Re-read it with:

keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android
./gradlew signingReport   # lists SHA-1/SHA-256 per build variant