feat(ci): add GitHub Actions workflow for Android APK build

- Trigger on push to main (web/tauri/shared changes), PR, and manual
- Builds Vite frontend + Tauri Rust for 4 Android arches
- Signs APK with keystore from GitHub secrets
- Uploads signed APK + AAB as artifact

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/android.yml

@@ -0,0 +1,116 @@
+name: Build Android APK
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'apps/web/**'
+      - 'apps/tauri/**'
+      - 'packages/shared/**'
+      - '.github/workflows/android.yml'
+  pull_request:
+    paths:
+      - 'apps/web/**'
+      - 'apps/tauri/**'
+      - 'packages/shared/**'
+      - '.github/workflows/android.yml'
+  workflow_dispatch:
+
+env:
+  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || 'https://zeavisedu.asepharyana.tech' }}
+
+jobs:
+  build-apk:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Setup Java 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '21'
+
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
+        with:
+          packages: 'platforms;android-36 build-tools;36.0.0 ndk;28.0.13004108'
+
+      - name: Setup Rust with Android targets
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: >-
+            aarch64-linux-android,
+            armv7-linux-androideabi,
+            i686-linux-android,
+            x86_64-linux-android
+
+      - name: Cache Cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            apps/tauri/target
+          key: ${{ runner.os }}-cargo-android-${{ hashFiles('apps/tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-android-
+
+      - name: Install Tauri CLI
+        run: cd apps/tauri && bun install
+
+      - name: Build Tauri Android APK
+        working-directory: apps/tauri
+        env:
+          JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
+          ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
+          NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
+        run: bun tauri android build
+
+      - name: Decode keystore
+        if: github.event_name != 'pull_request'
+        env:
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+        run: |
+          echo "$ANDROID_KEYSTORE_BASE64" | base64 -d > apps/tauri/zeavis.keystore
+
+      - name: Sign APK
+        if: github.event_name != 'pull_request'
+        env:
+          ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          ANDROID_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          APK_UNSIGNED=$(find apps/tauri/gen/android/app/build/outputs/apk -name '*.apk' ! -name '*-signed*' | head -1)
+          APK_SIGNED="${APK_UNSIGNED%.apk}-signed.apk"
+          $ANDROID_SDK_ROOT/build-tools/36.0.0/apksigner sign \
+            --ks apps/tauri/zeavis.keystore \
+            --ks-pass "pass:${ANDROID_KEYSTORE_PASSWORD}" \
+            --ks-key-alias "${ANDROID_KEY_ALIAS}" \
+            --key-pass "pass:${ANDROID_KEY_PASSWORD}" \
+            --out "$APK_SIGNED" \
+            "$APK_UNSIGNED"
+          echo "Signed APK: $APK_SIGNED"
+          ls -lh "$APK_SIGNED"
+
+      - name: Upload APK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: zeavis-edu-android
+          path: |
+            apps/tauri/gen/android/app/build/outputs/apk/**/*.apk
+            apps/tauri/gen/android/app/build/outputs/bundle/**/*.aab
+          retention-days: 30