feat: release signing via secrets.properties and shared keystore

Gradle reads signing credentials from repo-root secrets.properties;
secrets.properties.example documents setup for work and home builds.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/build.gradle.kts

@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     id("com.android.application")
     id("org.jetbrains.kotlin.android")
@@ -5,6 +7,15 @@ plugins {
     id("org.jetbrains.kotlin.plugin.serialization")
 }
 
+val secretsFile = rootProject.file("secrets.properties")
+val releaseSecrets = Properties().apply {
+    if (secretsFile.exists()) {
+        secretsFile.inputStream().use { load(it) }
+    }
+}
+val releaseKeystoreConfigured = secretsFile.exists() &&
+    releaseSecrets.getProperty("SEACA_STORE_FILE") != null
+
 android {
     namespace = "ru.kalinamall.seaca"
     compileSdk = 35
@@ -17,8 +28,22 @@ android {
         versionName = "0.5.15"
     }
 
+    signingConfigs {
+        if (releaseKeystoreConfigured) {
+            create("release") {
+                storeFile = rootProject.file(releaseSecrets.getProperty("SEACA_STORE_FILE"))
+                storePassword = releaseSecrets.getProperty("SEACA_STORE_PASSWORD")
+                keyAlias = releaseSecrets.getProperty("SEACA_KEY_ALIAS")
+                keyPassword = releaseSecrets.getProperty("SEACA_KEY_PASSWORD")
+            }
+        }
+    }
+
     buildTypes {
         release {
+            if (releaseKeystoreConfigured) {
+                signingConfig = signingConfigs.getByName("release")
+            }
             isMinifyEnabled = false
             proguardFiles(
                 getDefaultProguardFile("proguard-android-optimize.txt"),