Build the Android app on our own Gitea runner

Pushing a v* tag builds the normal and FOSS APKs, signed with the upload
key, and attaches them to a Gitea release; a manual run on a branch
uploads a test build to the repo's packages. Everything runs on the
Gitea server: a builder image with the Android SDK, an act_runner
registered only for this repo, and plain shell steps (no third-party
actions). The build itself is apps/mobile/scripts/build-android.sh, the
same script for hand builds. Setup steps are in docs/ANDROID-CI.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/gitea-runner/compose.yml

@@ -0,0 +1,19 @@
+# Gitea Actions runner for building the Android app (.gitea/workflows/android.yml).
+# Runs on the Gitea server; see docs/ANDROID-CI.md for setup.
+#
+# It starts build containers through the host's Docker, so it has the same power as
+# root on this machine: only register it for the musicshare repository.
+services:
+  runner:
+    image: gitea/act_runner:0.6.1
+    restart: unless-stopped
+    environment:
+      GITEA_INSTANCE_URL: https://gitea.chrisedwards.tech
+      # From the repo: Settings > Actions > Runners > Create new runner. Only needed the first time.
+      GITEA_RUNNER_REGISTRATION_TOKEN: ${RUNNER_TOKEN:-}
+      GITEA_RUNNER_NAME: musicshare-android
+      CONFIG_FILE: /config.yaml
+    volumes:
+      - ./config.yaml:/config.yaml:ro
+      - ./data:/data
+      - /var/run/docker.sock:/var/run/docker.sock

deploy/gitea-runner/config.yaml

@@ -0,0 +1,23 @@
+# act_runner settings (full reference: `docker run --rm gitea/act_runner:0.6.1 act_runner generate-config`).
+log:
+  level: info
+
+runner:
+  file: /data/.runner
+  # One build at a time: an Android build wants several GB of memory.
+  capacity: 1
+  timeout: 3h
+  labels:
+    - "musicshare-android:docker://musicshare-android-builder"
+
+cache:
+  enabled: false
+
+container:
+  # Use the locally built deploy/android-builder image rather than pulling from a registry.
+  force_pull: false
+  privileged: false
+  # The volumes the workflow may mount (Gradle and npm caches), and nothing else.
+  valid_volumes:
+    - musicshare-gradle
+    - musicshare-npm