ci: move workflows to the repository root

GitHub only runs workflows from .github/workflows at the root, so the six
workflows inherited from the two projects have to live there rather than under
web/ and android/. Each one gets a path filter so web-only changes do not
trigger Android builds, a working directory for its subproject, and a prefixed
filename to keep the two sets apart.

Gradle now sits at android/android, the Firebase action reads its config from
web/ via entryPoint, and the Android checkout no longer needs submodules.

android/.github/workflows/build-debug.yml

@@ -1,49 +0,0 @@
-name: build-debug
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          submodules: recursive
-
-      - name: Set up Node 22
-        uses: actions/setup-node@v7
-        with:
-          node-version: '22'
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: '21'
-
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-provider: basic
-
-      - name: Install wrapper deps
-        run: npm ci
-
-      - name: Build loto + sync into Android
-        run: npm run build
-
-      - name: Assemble debug APK
-        working-directory: android
-        run: ./gradlew :app:assembleDebug
-
-      - name: Upload debug APK
-        uses: actions/upload-artifact@v7
-        with:
-          name: app-debug.apk
-          path: android/app/build/outputs/apk/debug/*.apk
-          archive: false
-          retention-days: 7

android/.github/workflows/release.yml

@@ -1,90 +0,0 @@
-name: release
-
-on:
-  push:
-    tags: ['v*.*.*']
-
-permissions:
-  contents: write
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          submodules: recursive
-          persist-credentials: false
-
-      - name: Set up Node 22
-        uses: actions/setup-node@v7
-        with:
-          node-version: '22'
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v5
-        with:
-          distribution: temurin
-          java-version: '21'
-
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-provider: basic
-
-      - name: Install wrapper deps
-        run: npm ci
-
-      - name: Build loto + sync into Android
-        run: npm run build
-
-      - name: Decode keystore
-        env:
-          KEYSTORE_BASE64: ${{ secrets.KEYSTORE_BASE64 }}
-        run: printf '%s' "$KEYSTORE_BASE64" | base64 --decode > keystore.p12
-
-      - name: Build signed AAB + APK
-        working-directory: android
-        env:
-          LOTO_KEYSTORE_PATH: ${{ github.workspace }}/keystore.p12
-          LOTO_KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
-          LOTO_KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
-          LOTO_KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
-        run: ./gradlew :app:bundleRelease :app:assembleRelease
-
-      - name: Upload to GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
-        with:
-          files: |
-            android/app/build/outputs/apk/release/*.apk
-            android/app/build/outputs/bundle/release/*.aab
-
-      # Auto-publish to Google Play (gated on the service-account secret).
-      # Skips silently if PLAY_SERVICE_ACCOUNT_JSON is not configured, so
-      # tagging a release before Play setup still produces a GH Release.
-      # Default track is "internal" — change to alpha/beta/production
-      # once you trust the pipeline.
-      - name: Check Play Store config
-        id: play
-        env:
-          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-        run: |
-          if [ -n "$PLAY_SERVICE_ACCOUNT_JSON" ]; then
-            echo "configured=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "configured=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::PLAY_SERVICE_ACCOUNT_JSON not set; skipping Play Store upload."
-          fi
-
-      - name: Upload to Google Play (internal track)
-        if: steps.play.outputs.configured == 'true'
-        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1.1.5
-        with:
-          serviceAccountJsonPlainText: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
-          packageName: com.miti99.loto
-          releaseFiles: android/app/build/outputs/bundle/release/*.aab
-          tracks: internal
-          status: completed
-          # Bumps versionCode automatically? No — must be incremented
-          # manually in android/app/build.gradle before tagging.