Require dedicated release signing for APK builds

README.md

@@ -98,6 +98,17 @@ available, it falls back to the repo-managed Docker build image, which also
 uses Java 25. You still need the Android SDK and NDK installed and configured
 for real device or release packaging.
 
+Release package:
+
+```bash
+make apk-release
+```
+
+`make apk-release` is the production-signing path. It requires a dedicated
+release keystore at `~/.config/keepassgo/android-release.keystore` and a
+password file at `~/.config/keepassgo/android-release.pass`, unless you
+override `RELEASE_SIGNKEY` and `RELEASE_SIGNPASS_FILE`.
+
 ## Automation
 
 Desktop automation is resolved through the secure gRPC API rather than synthetic auto-type.