ci: move workflows to the repository root

GitHub only runs workflows from .github/workflows at the root, so the six
workflows inherited from the two projects have to live there rather than under
web/ and android/. Each one gets a path filter so web-only changes do not
trigger Android builds, a working directory for its subproject, and a prefixed
filename to keep the two sets apart.

Gradle now sits at android/android, the Firebase action reads its config from
web/ via entryPoint, and the Android checkout no longer needs submodules.

.github/workflows/android-release.yml

@@ -0,0 +1,93 @@
+name: android / release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: android
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Node 22
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v6
+        with:
+          cache-provider: basic
+
+      - name: Install wrapper deps
+        run: npm ci
+
+      - name: Build web + sync into Android
+        run: npm run build
+
+      - name: Decode keystore
+        env:
+          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
+        run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > "$GITHUB_WORKSPACE/keystore.p12"
+
+      - name: Build signed AAB + APK
+        working-directory: android/android
+        env:
+          LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
+          LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: ./gradlew :app:bundleRelease :app:assembleRelease
+
+      - name: Upload to GitHub Release
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        with:
+          files: |
+            android/android/app/build/outputs/apk/release/*.apk
+            android/android/app/build/outputs/bundle/release/*.aab
+
+      # Auto-publish to Google Play (gated on the service-account secret).
+      # Skips silently if PLAY_SERVICE_ACCOUNT_JSON is not configured, so
+      # tagging a release before Play setup still produces a GH Release.
+      # Default track is "internal" — change to alpha/beta/production
+      # once you trust the pipeline.
+      - name: Check Play Store config
+        id: play
+        env:
+          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+        run: |
+          if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            echo "configured=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not set; skipping Play Store upload."
+          fi
+
+      - name: Upload to Google Play (internal track)
+        if: steps.play.outputs.configured == 'true'
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
+        with:
+          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
+          packageName: com.miti99.loto
+          releaseFiles: android/android/app/build/outputs/bundle/release/*.aab
+          tracks: internal
+          status: completed
+          # Bumps versionCode automatically? No — must be incremented
+          # manually in android/android/app/build.gradle before tagging.