Publish a signed Play AAB from Deploy Prod.

Closes #121. Supersedes the separate Deploy Android workflow in #58 by attaching hesychia-<version>-<code>.aab to an android-v* Gitea release after the prod web deploy.

llm-fe/ANDROID.md

@@ -50,12 +50,37 @@ After plugin changes: `npm run build:mobile` (runs `cap sync`).
 
 ## Versioning
 
-In `android/app/build.gradle`:
+`android/app/build.gradle` keeps a floor:
 
-- **versionName** — user-visible string; keep aligned with `package.json` `version` (currently `0.1.0`)
-- **versionCode** — integer; **must increase** for every Play Store upload
+- `hesychiaVersionNameFloor` — `"0.1.0"` (user-visible string)
+- `hesychiaVersionCodeFloor` — `1` (integer; Play requires a higher code on every upload)
 
-Bump both before each store release.
+Local `./gradlew bundleRelease` uses that floor when you do not pass properties. **Deploy Prod** does not edit the file. After the web deploy it looks up existing `android-v*` Gitea releases, reuses the pair when the tag already points at this commit, otherwise ships the next patch and the next `versionCode` via `-PhesychiaVersionName` / `-PhesychiaVersionCode`.
+
+Raise the floor in git only when you want the next automatic release to jump ahead of older tags.
+
+## Deploy Prod publishes the Play bundle
+
+**Deploy Prod** (`.gitea/workflows/deploy-prod.yml`) runs `android-release` after the prod web deploy of the same commit. The job:
+
+1. Resolves the Play version (`llm-fe/scripts/android-version.mjs`)
+2. `npm run build:android:store` — `.env.mobile` (prod API) plus `cap sync android`
+3. Signs with the upload keystore on the runner (`~/.android/`, not in git)
+4. `jarsigner -verify` on `app-release.aab`
+5. Creates or reuses a Gitea release tagged `android-v<versionName>-<versionCode>` and attaches `hesychia-<versionName>-<versionCode>.aab`
+
+Example of the same shape on RealPath: [android-v1.0.2-3](https://git.aimloperations.com/Ditch_The_Agent/dta_webapp/releases/tag/android-v1.0.2-3).
+
+Download that AAB from the Gitea release and upload it to the Play **internal** track. Deploy Prod does not call the Play Developer API. A separate **Deploy Android** workflow is not used ([#58](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/58) is superseded by this job, [#121](https://git.aimloperations.com/ai_ml_operations/chat_web_app/issues/121)).
+
+Manual store binary (same web bundle the job builds):
+
+```bash
+cd llm-fe
+npm run build:android:store
+cd android
+./gradlew bundleRelease
+```
 
 ## Icons / splash
 
@@ -76,23 +101,39 @@ Same command also regenerates iOS `Assets.xcassets` (see [`IOS.md`](IOS.md)).
 
 ## Signing (upload keystore)
 
-**Never commit keystores.** Store outside the repo (e.g. host secrets / password manager).
+**Never commit keystores or `keystore.properties`.** Passwords stay on the runner, not in Gitea Actions secrets.
+
+Deploy Prod expects these host files (separate from RealPath’s `keystore.properties`, so the two apps do not share one symlink target):
+
+```text
+/home/westfarn/.android/hesychia-upload.jks
+/home/westfarn/.android/hesychia-keystore.properties   # mode 600
+```
+
+Create the upload key **once**. If Play already has an upload key for `ai.hesychia.chat`, reuse that keystore. A second keystore will not upload.
 
 ```bash
-keytool -genkey -v -keystore ~/Documents/secrets/aiml-chat-upload.jks \
+keytool -genkey -v \
+  -keystore /home/westfarn/.android/hesychia-upload.jks \
   -keyalg RSA -keysize 2048 -validity 10000 \
   -alias aiml-chat-upload
 ```
 
-Create `llm-fe/android/keystore.properties` (gitignored):
+`hesychia-keystore.properties` (`storeFile` may be absolute):
 
 ```properties
-storeFile=/absolute/path/to/aiml-chat-upload.jks
+storeFile=/home/westfarn/.android/hesychia-upload.jks
 storePassword=...
 keyAlias=aiml-chat-upload
 keyPassword=...
 ```
 
+The workflow symlinks that file to `llm-fe/android/keystore.properties` and writes `android/local.properties` with `sdk.dir=/home/westfarn/Android/Sdk`. For a local release build, put the same `keystore.properties` in `llm-fe/android/` (gitignored).
+
+Also on the runner: JDK 17+ and Android SDK Platform 35 at `/home/westfarn/Android/Sdk`.
+
+Gitea Actions secret on `chat_web_app`: `GITHUB_TOKEN` (repo release write). The workflow maps it to `GITEA_TOKEN` for version lookup and release upload. Purchase verification uses backend `GOOGLE_PLAY_SERVICE_ACCOUNT_JSON`, not this keystore.
+
 Release App Bundle:
 
 ```bash