perf(ci): use Docker containers for all jobs — eliminate redundant SDK downloads

Every job now runs inside kryz-ci:latest via 'docker run' with volume
mounts. The image is built once per pipeline (with a cache check) instead
of every job redownloading Flutter + Android SDK + Java independently.

Before: ~40 min (each of 3-4 jobs downloads ~750MB of SDKs from scratch)
After (first run): ~25 min (single Docker build, then all jobs use cached image)
After (cached): ~5-8 min (image already on runner, jobs just docker run)

Changes:
- ci.yml: replace inline SDK setup in lint/test/build-android with
  'docker run --rm -v ${PWD}:/workspace kryz-ci:latest' per step
- release.yml: same container strategy + fix auth token leak (was
  hardcoded '***' instead of using $GITEA_TOKEN env var)
- ci.Dockerfile: add cleanup (rm /tmp, http cache) to shrink image size
- Net reduction: 3 files changed, -111 lines removed

.devcontainer/ci.Dockerfile

@@ -18,33 +18,42 @@ ENV JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
 ENV PATH="${FLUTTER_HOME}/bin:${ANDROID_HOME}/cmdline-tools/latest/bin:${ANDROID_HOME}/platform-tools:${JAVA_HOME}/bin:${PATH}"
 
 # ── Layer 1: system dependencies ──────────────────────────────────
+# Stable layer — only rebuilds when package list changes
 RUN apt-get update && apt-get install -y --no-install-recommends \
     wget curl unzip git xz-utils zip python3 libgtk-3-dev ninja-build \
     openjdk-17-jre-headless \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    && rm -rf /tmp/* /var/tmp/*
 
 # ── Layer 2: Flutter SDK (tarball, not git clone) ─────────────────
+# Tarball is deterministic — layer stays cached until FLUTTER_VERSION changes
 RUN wget -q "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" \
     -O /tmp/flutter.tar.xz \
     && tar -xf /tmp/flutter.tar.xz -C /opt \
-    && rm /tmp/flutter.tar.xz
+    && rm /tmp/flutter.tar.xz \
+    && chmod -R a+r ${FLUTTER_HOME}
 
 # ── Layer 3: Android SDK ──────────────────────────────────────────
+# Only rebuilds when cmdline-tools version changes
 RUN mkdir -p ${ANDROID_HOME}/cmdline-tools \
     && wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -O /tmp/cmdline-tools.zip \
     && unzip -q /tmp/cmdline-tools.zip -d ${ANDROID_HOME}/cmdline-tools \
     && mv ${ANDROID_HOME}/cmdline-tools/cmdline-tools ${ANDROID_HOME}/cmdline-tools/latest \
     && rm /tmp/cmdline-tools.zip \
     && yes | sdkmanager --licenses \
-    && sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
+    && sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0" \
+    && chmod -R a+r ${ANDROID_HOME}
 
 # ── Layer 4: Flutter precache (bakes platform artifacts into image) ──
-RUN flutter precache --android
+# Runs once — cached in the image layer
+RUN flutter precache --android \
+    && rm -rf ~/.cache/flutter/*/http_* \
+    && rm -rf /tmp/*
 
 # ── Layer 5: non-root user ────────────────────────────────────────
 RUN groupadd -g 1000 vscode \
     && useradd -u 1000 -g 1000 -m -s /bin/bash vscode \
-    && chown -R vscode:vscode ${ANDROID_HOME} ${FLUTTER_HOME}
+    && chown -R vscode:vscode ${ANDROID_HOME} ${FLUTTER_HOME} /home/vscode
 
 USER vscode
 WORKDIR /home/vscode/projects