Release signing from gitignored keystore.properties

Keystore at ~/.keystores/meddetsamme-release.jks (4096-bit RSA, 30 yr),
credentials in keystore.properties — both outside version control. A
clone without the file still builds (unsigned release) instead of
failing, so nothing breaks for CI or a fresh checkout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -1,6 +1,8 @@
 .gradle/
 build/
 local.properties
+keystore.properties
+*.jks
 .kotlin/
 *.iml
 .idea/

app/build.gradle.kts

@@ -1,3 +1,5 @@
+import java.util.Properties
+
 plugins {
     alias(libs.plugins.android.application)
     // AGP 9 has built-in Kotlin (org.jetbrains.kotlin.android is gone); only the
@@ -12,6 +14,13 @@ ksp {
     arg("room.schemaLocation", "$projectDir/schemas")
 }
 
+// Release signing from gitignored keystore.properties (keystore lives in
+// ~/.keystores). Absent file → unsigned release, so CI/fresh clones still build.
+val keystoreProps = Properties().apply {
+    val f = rootProject.file("keystore.properties")
+    if (f.exists()) f.inputStream().use(::load)
+}
+
 android {
     namespace = "no.naiv.meddetsamme"
     // compileSdk 37: required by current AndroidX (core 1.19 / compose BOM 2026.05).
@@ -26,10 +35,24 @@ android {
         versionName = "0.1.0"
     }
 
+    signingConfigs {
+        if (keystoreProps.isNotEmpty()) {
+            create("release") {
+                storeFile = file(keystoreProps.getProperty("storeFile"))
+                storePassword = keystoreProps.getProperty("storePassword")
+                keyAlias = keystoreProps.getProperty("keyAlias")
+                keyPassword = keystoreProps.getProperty("keyPassword")
+            }
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = false
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"))
+            if (keystoreProps.isNotEmpty()) {
+                signingConfig = signingConfigs.getByName("release")
+            }
         }
     }