build(train): Train is released as Learn is, with a key of its own, beside it in the F-Droid repository (ADR 0030, D58)

apps/train/release.dart configures the release tool for Train's APK on
train.halkyon.eu; its release builds sign with its own key when the tool
hands it over. Its F-Droid listing declares NonFreeDep for Polar's SDK and
NonFreeNet; the repository's script copies each app's icon. The key's
certificate is pinned once the key is made.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/train/halkyon_train_flutter/android/app/build.gradle.kts

@@ -15,7 +15,6 @@ android {
     }
 
     defaultConfig {
-        // TODO: Specify your own unique Application ID (https://developer.android.com/studio/build/application-id.html).
         applicationId = "app.halkyon.train"
         // You can update the following values to match your application needs.
         // For more information, see: https://flutter.dev/to/review-gradle-config.
@@ -30,13 +29,46 @@ android {
         versionName = flutter.versionName
     }
 
+    // The app's own key signs release builds when tool/release.dart hands it over
+    // through the environment, as Learn's does: the keystore's path and the key's
+    // alias, and the password asked for at each release, never written down. Other
+    // release builds are signed with the debug key, so `flutter run --release` works
+    // anywhere; the release tool releases no APK signed otherwise.
+    val releaseKeystore = System.getenv("HALKYON_ANDROID_KEYSTORE")
+    signingConfigs {
+        if (releaseKeystore != null) {
+            create("release") {
+                storeFile = file(releaseKeystore)
+                keyAlias = System.getenv("HALKYON_ANDROID_KEY_ALIAS")
+                // A PKCS #12 keystore has one password, for the store and its key.
+                storePassword = System.getenv("HALKYON_ANDROID_KEYSTORE_PASSWORD")
+                keyPassword = System.getenv("HALKYON_ANDROID_KEYSTORE_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         release {
-            // TODO: Add your own signing config for the release build.
-            // Signing with the debug keys for now, so `flutter run --release` works.
-            signingConfig = signingConfigs.getByName("debug")
+            signingConfig =
+                signingConfigs.findByName("release") ?: signingConfigs.getByName("debug")
         }
     }
+
+    // The native libraries go into the APK compressed, as Learn's: one APK serves
+    // every phone, holding them for three architectures, and Android unpacks the
+    // phone's own as it installs the app.
+    packaging {
+        jniLibs {
+            useLegacyPackaging = true
+        }
+    }
+
+    // Leaves out the list of dependencies Gradle would otherwise add to the APK,
+    // encrypted for Google Play alone; F-Droid's and others' scanners flag it.
+    dependenciesInfo {
+        includeInApk = false
+        includeInBundle = false
+    }
 }
 
 kotlin {