Release: also build AAB; fix keystore key-password guidance

- release.yml android job: build APK + AAB (bundleRelease/bundleDebug)
- androidApp: versionCode overridable via -PappVersionCode (Play requires
  an incrementing versionCode per upload)
- make_release_keystore.sh: PKCS12 has no separate key password (keytool
  ignores -keypass) — print the store password for ANDROID_KEY_PASSWORD

.gitea/workflows/release.yml

@@ -113,24 +113,31 @@ jobs:
             echo "::warning::ANDROID_KEYSTORE_BASE64 secret not set — falling back to a DEBUG apk (see CI-SETUP.md §5)"
           fi
 
-      - name: Build APK
+      - name: Build APK + AAB
         run: |
           VERSION=$(jq -r '.inputs.version' "$GITHUB_EVENT_PATH")
           cd app
           if [ -n "$ANDROID_KEYSTORE_FILE" ]; then
-            ./gradlew :androidApp:assembleRelease -PappVersion="$VERSION"
+            # APK for direct sideloading, AAB for Play Store uploads.
+            ./gradlew :androidApp:assembleRelease :androidApp:bundleRelease -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/release/androidApp-release.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION.apk"
+            cp androidApp/build/outputs/bundle/release/androidApp-release.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION.aab"
           else
-            ./gradlew :androidApp:assembleDebug -PappVersion="$VERSION"
+            ./gradlew :androidApp:assembleDebug :androidApp:bundleDebug -PappVersion="$VERSION"
             cp androidApp/build/outputs/apk/debug/androidApp-debug.apk \
               "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.apk"
+            cp androidApp/build/outputs/bundle/debug/androidApp-debug.aab \
+              "$GITHUB_WORKSPACE/iris-android-v$VERSION-debug.aab"
           fi
 
       - uses: actions/upload-artifact@v4
         with:
           name: android
-          path: iris-android-*.apk
+          path: |
+            iris-android-*.apk
+            iris-android-*.aab
 
   desktop:
     name: Build desktop (Linux, jpackage)
@@ -217,4 +224,4 @@ jobs:
             curl -sf -X POST -H "$AUTH" -F "attachment=@$f" \
               "$API/releases/$RELEASE_ID/attachments" > /dev/null
           done
-          echo "Done: $SERVER/$REPO/releases/tag/$TAG"
+          echo "Done: $SERVER/$REPO/releases/tag/$TAG"