feat(ci): 客户端 CI 脚手架(Android+Windows, 照 jiu)——起草+Android 本地验证

- compile-android.sh: 建 libbox.aar + split-per-abi 取 arm64-v8a(~82MB, 避 232MB
  universal) + release 签名(RELEASE_KEYSTORE/KEY_PASSWORD)。本地已验证构建通过、
  libbox.so 打进 APK。
- compile-windows.sh: 复用 client/windows/installer/pangolin.iss(Inno Setup),不签名。
- release-client.sh / deploy-client.sh: 复用 pangolin lib-forgejo/lib-ssh,传 Gitea
  release + 部署最新到 pangolin1:/var/lib/pangolin/downloads(仅留最新)。
- deploy-client.yml: client-v* tag → build-android(mac)+build-windows(windows) → release-deploy(mac)。
- build.gradle: 补 release 签名 config(读 key.properties, 缺则回退 debug)。
- 待确认: keystore alias/密码(见脚本 TODO);runner 需提到 user 级;服务器 /downloads + 官网链接下一步。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

.gitea/workflows/deploy-client.yml

@@ -0,0 +1,117 @@
+name: Deploy Client
+
+# Mirrors ~/code/jiu/.gitea/workflows/deploy-client.yml's tag→build→release→
+# deploy shape, trimmed to the two platforms drafted so far (Android +
+# Windows — no client-web/macOS/iOS jobs; pangolin has no Flutter-web build
+# in this pipeline and macOS/iOS are a separate not-yet-drafted phase, see
+# docs/superpowers/plans/2026-07-05-cicd.md Phase 3).
+#
+# TODO(controller) — RUNNER AVAILABILITY: per docs/ci-runner.md, pangolin
+# currently has exactly ONE registered Gitea Actions runner
+# ("mac-pangolin-2", label `nas:host`). Neither `runs-on: mac` nor
+# `runs-on: windows` below has any runner registered to pick it up yet — this
+# workflow will queue forever until that's fixed. Options: (a) register
+# mac-pangolin-2 with an additional `mac` label (it's already a mac host —
+# cheapest fix for build-android/release-deploy) and separately stand up +
+# register an actual Windows host runner labeled `windows` for build-windows
+# (no such machine exists per docs/ci-runner.md), or (b) repoint both at
+# `nas` and accept that Android/Windows builds then compete with the
+# docker-in-domain nas jobs on the same single mac host. This mirrors the
+# `runs-on: mac` / `runs-on: windows` split already planned in
+# docs/superpowers/plans/2026-07-05-cicd.md Task 7/10 — written that way here
+# for fidelity to that plan, NOT because the runners are confirmed to exist.
+on:
+  push:
+    tags:
+      - 'client-v[0-9]*.[0-9]*.[0-9]*'
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-client
+  cancel-in-progress: false
+
+jobs:
+  build-android:
+    runs-on: mac
+    env:
+      GOPROXY: https://goproxy.cn,direct
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile (Android APK)
+        env:
+          RELEASE_KEYSTORE: ${{ secrets.RELEASE_KEYSTORE }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: bash scripts/ci/compile-android.sh "${{ gitea.ref_name }}"
+
+      - name: Upload android artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: android
+          path: dist/
+
+  build-windows:
+    runs-on: windows
+    env:
+      GOPROXY: https://goproxy.cn,direct
+      PUB_HOSTED_URL: https://pub.flutter-io.cn
+      FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Compile (Windows installer)
+        shell: bash
+        run: bash scripts/ci/compile-windows.sh "${{ gitea.ref_name }}"
+
+      - name: Upload windows artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: windows
+          path: dist/
+
+  release-deploy:
+    needs: [build-android, build-windows]
+    runs-on: mac
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download android artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: android
+          path: dist/
+
+      - name: Download windows artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: windows
+          path: dist/
+
+      - name: Release → Forgejo
+        env:
+          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          FORGEJO_URL: ${{ secrets.FORGEJO_URL }}
+        run: bash scripts/ci/release-client.sh "${{ gitea.ref_name }}"
+
+      - name: Deploy → pangolin1 (downloads/)
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: bash scripts/ci/deploy-client.sh "${{ gitea.ref_name }}"
+
+      - name: Notify
+        if: always()
+        env:
+          TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: |
+          . scripts/ci/notify.sh
+          if [ "${{ job.status }}" = "success" ]; then
+            notify_ok "client ${{ gitea.ref_name }} released + deployed"
+          else
+            notify_fail "client ${{ gitea.ref_name }} pipeline failed"
+          fi