Require dedicated release signing for APK builds

APK.md

@@ -6,11 +6,22 @@ Build the APK with:
 make apk
 ```
 
+Build the release-signed APK with:
+
+```sh
+make apk-release
+```
+
 `make apk` uses a local Java 25 install when `JAVA_HOME` points to one.
 If the host does not have a working Java 25 install, it falls back to the
 repo-managed Docker image in `packaging/docker/android-apk/`, which also builds
 with Java 25.
 
+`make apk` remains a developer build path and may use Gio's default debug or
+ephemeral signing behavior if no explicit signing key is provided.
+`make apk-release` is the production-signing path and fails unless a dedicated
+release keystore and password file are present.
+
 Environment:
 
 - `ANDROID_SDK_ROOT` defaults to `/opt/android-sdk`.
@@ -23,6 +34,13 @@ Environment:
 - `APK_VERSION` overrides the packaged app version.
 - `ANDROID_MIN_SDK` overrides the minimum supported Android SDK.
 - `ANDROID_TARGET_SDK` overrides the target Android SDK.
+- `RELEASE_SIGNKEY` overrides the release keystore path used by `make apk-release`.
+- `RELEASE_SIGNPASS_FILE` overrides the password file path used by `make apk-release`.
+
+Default release-signing paths:
+
+- `~/.config/keepassgo/android-release.keystore`
+- `~/.config/keepassgo/android-release.pass`
 
 Installed machine prerequisites expected by this repo:
 
@@ -38,6 +56,9 @@ The repo tracks `gogio` as a Go tool, and the local build runs through:
 go tool gogio -target android ./cmd/keepassgo ...
 ```
 
+The release target wraps `make apk` and injects explicit signing credentials so
+local release builds and CI use the same stable key.
+
 The Android build uses the branded icon asset at:
 
 - `internal/assets/keepassgo-icon.png`