[CodeByArnob]

Summary

Replaces the unsafe implicit debug signing for Android release builds with an explicit production keystore configuration.

Changes

• Loads production signing credentials from the ignored local android/key.properties file.
• Fails a normal release build when the production keystore is missing or incomplete.
• Allows debug signing only when FOODLENS_ALLOW_DEBUG_SIGNING=true is explicitly set, for CI verification builds only.
• Updates the CI workflow to make its verification-only debug signing explicit.
• Adds documentation/ANDROID_RELEASE_SIGNING.md with Windows PowerShell keystore creation, local configuration, SHA-256 fingerprint retrieval, backup guidance, and GitHub Actions secret names.

Security

• No keystore, password, Base64 key material, or private credential is committed.
• CI verification APKs remain debug-signed and must not be distributed as production releases.
• Production signing automation and Android App Links are intentionally not enabled until the owner creates and safely backs up the permanent keystore.

Verification

CI will run formatting, Flutter analysis, tests, and the explicitly debug-signed verification APK build. A production-signed APK still requires the owner's local keystore configuration.