Add Gitea CI + release workflows (CI-SETUP.md)

- .gitea/workflows/ci.yml: gateway plugin tests + Kotlin host tests on
  push/PR (hermes-agent cloned at pinned SHA, vendored test mirror)
- .gitea/workflows/release.yml: manual dispatch; runs tests, builds signed
  Android APK (debug fallback) + Linux desktop app-image/deb via jpackage,
  creates Gitea release v<version> with artifacts (re-run safe)
- androidApp: versionName from -PappVersion, CI release signing from
  ANDROID_KEYSTORE_* env vars
- desktopApp: jpackage --app-version from -PappVersion
- scripts/make_release_keystore.sh: one-time keystore + Gitea secret setup
- vendor gateway-plugin/tests/test_android.py (byte-identical mirror) and
  ignore it in .pi-lens.json

app/desktopApp/build.gradle.kts

@@ -9,6 +9,9 @@ plugins {
 val composeVersion = "1.11.1"
 val os = OperatingSystem.current()
 val arch = System.getProperty("os.arch") ?: "amd64"
+// CI passes -PappVersion=<version> (release workflow); local builds keep the
+// default. jpackage requires a plain semver (no leading "v").
+val appVersion = (project.findProperty("appVersion") as? String) ?: "0.1.0"
 val desktopTarget = when {
     os.isMacOsX -> if (arch == "aarch64") "macos-arm64" else "macos-x64"
     os.isWindows -> "windows-x64"
@@ -79,7 +82,7 @@ tasks.register<Exec>("jpackage") {
     commandLine(
         if (jpackageBin.exists()) jpackageBin.absolutePath else "jpackage",
         "--name", "iris",
-        "--app-version", "0.1.0",
+        "--app-version", appVersion,
         "--vendor", "Iris",
         "--type", type,
         "--input", inputDir.absolutePath,