feat: an F-Droid repository at learn.halkyon.app

Releases also publish the APK in the project's own F-Droid repository,
https://learn.halkyon.app/fdroid/repo. tool/fdroid_repo.sh adds the APK,
signs the indexes with the repository's own key and uploads them to
ramiel as the user fdroid, whose key can only write into the folder
Caddy serves (rrsync), the APKs first and the indexes last.
tool/release.sh checks that key and its password before building and
publishes after the Forgejo release.

- tool/release/fdroid/ holds the repository's settings (Halkyon, the
  snap's icon) and the app's listing (the snap's text), with the
  anti-features TetheredNet (learn.halkyon.eu only, for now) and
  NonFreeNet (YouTube, the server's SSPL) declared with their reasons,
  in F-Droid's own definitions and with its icons (fdroiddata, AGPL v3).
- The index key's certificate is pinned: a new key would make the F-Droid
  app refuse the repository.
- fdroidserver v2.4.5, since Ubuntu's v2.2.1 knows neither TetheredNet
  nor reasons.

README and AGENTS.md describe it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

README.md

@@ -109,9 +109,11 @@ the CI runner described in `deploy/runner/`, deploys only commits signed by a ke
 
 ## Releases
 
-Releases are published on [code.halkyon.app](https://code.halkyon.app/project-halkyon/halkyon_learn/releases)
-and, for Linux, in the Snap Store (`halkyon-learn`). Their builds connect to
-learn.halkyon.eu, the project's instance.
+Releases are published on [code.halkyon.app](https://code.halkyon.app/project-halkyon/halkyon_learn/releases),
+for Android also in the project's F-Droid repository
+(`https://learn.halkyon.app/fdroid/repo?fingerprint=E8082788756F6B7E682AA22FCEAD24B53E2A8B0912AD66D65E8C2D4F07BB94B0`,
+added in the F-Droid app as a repository), and for Linux in the Snap Store
+(`halkyon-learn`). Their builds connect to learn.halkyon.eu, the project's instance.
 
 - **Checking a download:** `SHA256SUMS` lists the checksum of every file, signed with the
   maintainer's GPG key (`SHA256SUMS.asc`). The APK is signed with the app's key, whose
@@ -122,6 +124,9 @@ learn.halkyon.eu, the project's instance.
   `<major>.<minor>.<patch>+<build>`. Every release raises the build number: Android only
   installs a higher one over an older, and the server tells apps below the build it
   supports to update.
+- **The F-Droid repository** is kept by `tool/fdroid_repo.sh` (fdroidserver v2.4.5,
+  e.g. `pipx install fdroidserver==2.4.5`); its settings and the app's listing are in
+  `tool/release/fdroid/`.
 - **Making one** is for maintainers, on their own machine and never in CI:
   `tool/release.sh vX.Y.Z`. Its header says what it needs (the signed tag, the app's
   key, a Forgejo token, `snapcraft login`). It builds the APK and the snap