diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index be95210..d1a7055 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -29,7 +29,7 @@ env:
   FLUTTER_VERSION: "3.44.0"
 
 jobs:
-  # ── Stage 1: Lint & static analysis ──
+  # ── Stage 1: Lint & static analysis (best-effort on any runner) ──
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -41,11 +41,6 @@ jobs:
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
           curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
           export PATH="$PWD/flutter/bin:$PATH"
@@ -73,7 +68,7 @@ jobs:
           dart format lib/ test/
 
 
-  # ── Stage 1 (parallel): Unit & widget tests ──
+  # ── Stage 1 (parallel): Unit & widget tests (best-effort) ───────
   test:
     name: Test
     runs-on: ubuntu-latest
@@ -85,11 +80,6 @@ jobs:
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
           curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
           export PATH="$PWD/flutter/bin:$PATH"
@@ -111,14 +101,11 @@ jobs:
           flutter test --reporter=expanded
 
 
-  # ── Stage 2: Android build (inline setup - no container dependency) ──
-  # Removed container: kryz-ci:latest because the image may not exist on
-  # the runner host, causing the job to stall indefinitely on docker pull.
+  # ── Stage 3: Android build ──────────────────────────────────────
   build-android:
     name: Build Android
     runs-on: ubuntu-latest
     needs: [lint, test]
-    if: always()
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -132,56 +119,51 @@ jobs:
             exit 0
           fi
 
-      - name: Setup Java
+      - name: Setup Java 17
         run: |
           set -e
-          if command -v java &> /dev/null; then
-            echo "Java already available: $(java -version 2>&1 | head -1)"
-            export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
-            echo "JAVA_HOME=$JAVA_HOME"
-            exit 0
-          fi
-          apt-get update && apt-get install -y openjdk-17-jre-headless
-          export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
-          echo "JAVA_HOME=$JAVA_HOME"
+          curl -fsSL "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.12%2B7/OpenJDK17U-jdk_x64_linux_hotspot_17.0.12_7.tar.gz" \
+            -o /tmp/jdk.tar.gz
+          mkdir -p "$HOME/jdk"
+          tar -xzf /tmp/jdk.tar.gz -C "$HOME/jdk" --strip-components=1
+          export PATH="$HOME/jdk/bin:$PATH"
+          export JAVA_HOME="$HOME/jdk"
+          java -version
 
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
-          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
+          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" \
+            -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter --version
 
-      - name: Setup Android SDK
+      - name: Install Android SDK command-line tools
         run: |
           set -e
-          if [ -d "$ANDROID_HOME/cmdline-tools" ]; then
-            echo "Android SDK already present at $ANDROID_HOME"
-            exit 0
-          fi
-          # Install Android SDK from scratch
-          export ANDROID_HOME=$PWD/android-sdk
-          mkdir -p $ANDROID_HOME/cmdline-tools
-          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
-          unzip -q /tmp/cmdline-tools.zip -d $ANDROID_HOME/cmdline-tools
-          mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest
-          rm /tmp/cmdline-tools.zip
-          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
-          yes | sdkmanager --licenses
+          export JAVA_HOME="$HOME/jdk"
+          export PATH="$HOME/jdk/bin:$PATH"
+          export ANDROID_HOME="${HOME}/android-sdk"
+          mkdir -p "${ANDROID_HOME}/cmdline-tools"
+          curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -o /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d "${ANDROID_HOME}/cmdline-tools"
+          mv "${ANDROID_HOME}/cmdline-tools/cmdline-tools" "${ANDROID_HOME}/cmdline-tools/latest"
+          export PATH="${ANDROID_HOME}/cmdline-tools/latest/bin:${PATH}"
+          yes | sdkmanager --licenses >/dev/null 2>&1 || true
           sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
-          echo "Android SDK setup complete"
 
-      - name: Flutter precache Android
+      - name: Pre-cache Android platform artifacts
         run: |
           export PATH="$PWD/flutter/bin:$PATH"
           flutter precache --android
 
+      - name: Accept Android SDK licenses
+        run: |
+          export JAVA_HOME="$HOME/jdk"
+          export PATH="$HOME/jdk/bin:$PATH"
+          yes | "${HOME}/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses || true
+
       - name: Install dependencies
         run: |
           export PATH="$PWD/flutter/bin:$PATH"
@@ -200,11 +182,15 @@ jobs:
 
       - name: Build APK (release)
         run: |
+          export JAVA_HOME="$HOME/jdk"
+          export ANDROID_HOME="${HOME}/android-sdk"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter build apk --release
 
       - name: Build App Bundle (release)
         run: |
+          export JAVA_HOME="$HOME/jdk"
+          export ANDROID_HOME="${HOME}/android-sdk"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter build appbundle --release
 
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 5e3439a..b804f16 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -24,11 +24,6 @@ jobs:
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
           curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" \
             -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
@@ -49,7 +44,7 @@ jobs:
       - name: Analyze Dart code
         run: |
           export PATH="$PWD/flutter/bin:$PATH"
-          flutter analyze lib/ test/
+          flutter analyze --fatal-warnings
 
       - name: Check formatting
         run: |
@@ -69,11 +64,6 @@ jobs:
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
           curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" \
             -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
@@ -96,9 +86,7 @@ jobs:
           flutter test --reporter=expanded
 
 
-  # ── Android release build (inline setup - no container dependency) ──
-  # Removed container: kryz-ci:latest because the image may not exist on
-  # the runner host, causing the job to stall indefinitely on docker pull.
+  # ── Android release build ───────────────────────────────────
   build-android:
     name: Build Android Release
     runs-on: ubuntu-latest
@@ -107,64 +95,52 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Check platform for Android build
-        run: |
-          OS=$(uname -s)
-          echo "Detected OS: $OS"
-          if [ "$OS" != "Linux" ]; then
-            echo "SKIPPED: Android build requires Linux. Detected $OS."
-            exit 0
-          fi
-
-      - name: Setup Java
+      - name: Setup Java 17
         run: |
           set -e
-          if command -v java &> /dev/null; then
-            echo "Java already available: $(java -version 2>&1 | head -1)"
-            export JAVA_HOME=$(dirname $(dirname $(readlink -f $(which java))))
-            echo "JAVA_HOME=$JAVA_HOME"
-            exit 0
-          fi
-          apt-get update && apt-get install -y openjdk-17-jre-headless
-          export JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
-          echo "JAVA_HOME=$JAVA_HOME"
+          curl -fsSL "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.12%2B7/OpenJDK17U-jdk_x64_linux_hotspot_17.0.12_7.tar.gz" \
+            -o /tmp/jdk.tar.gz
+          mkdir -p "$HOME/jdk"
+          tar -xzf /tmp/jdk.tar.gz -C "$HOME/jdk" --strip-components=1
+          export PATH="$HOME/jdk/bin:$PATH"
+          export JAVA_HOME="$HOME/jdk"
+          java -version
 
       - name: Setup Flutter
         run: |
           set -e
-          if command -v flutter &> /dev/null; then
-            echo "Flutter already installed, skipping download."
-            flutter --version
-            exit 0
-          fi
-          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" -o /tmp/flutter.tar.xz
+          curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${{ env.FLUTTER_VERSION }}-stable.tar.xz" \
+            -o /tmp/flutter.tar.xz
           tar -xf /tmp/flutter.tar.xz -C "$PWD"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter --version
 
-      - name: Setup Android SDK
+      - name: Install Android SDK command-line tools
         run: |
           set -e
-          if [ -d "$ANDROID_HOME/cmdline-tools" ]; then
-            echo "Android SDK already present at $ANDROID_HOME"
-            exit 0
-          fi
-          export ANDROID_HOME=$PWD/android-sdk
-          mkdir -p $ANDROID_HOME/cmdline-tools
-          curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o /tmp/cmdline-tools.zip
-          unzip -q /tmp/cmdline-tools.zip -d $ANDROID_HOME/cmdline-tools
-          mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest
-          rm /tmp/cmdline-tools.zip
-          export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
-          yes | sdkmanager --licenses
+          export ANDROID_HOME="${HOME}/android-sdk"
+          mkdir -p "${ANDROID_HOME}/cmdline-tools"
+          curl -fsSL "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip" -o /tmp/cmdline-tools.zip
+          unzip -q /tmp/cmdline-tools.zip -d "${ANDROID_HOME}/cmdline-tools"
+          mv "${ANDROID_HOME}/cmdline-tools/cmdline-tools" "${ANDROID_HOME}/cmdline-tools/latest"
+          export PATH="${ANDROID_HOME}/cmdline-tools/latest/bin:${PATH}"
+          yes | sdkmanager --licenses >/dev/null 2>&1 || true
           sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
-          echo "Android SDK setup complete"
 
-      - name: Flutter precache Android
+      - name: Pre-cache Android platform artifacts
         run: |
           export PATH="$PWD/flutter/bin:$PATH"
           flutter precache --android
 
+      - name: Accept Android SDK licenses
+        run: |
+          yes | "${HOME}/android-sdk/cmdline-tools/latest/bin/sdkmanager" --licenses || true
+
+      - name: Setup Python
+        run: |
+          set -e
+          python3 --version
+
       - name: Install Python dependencies
         run: |
           python3 -m pip install --upgrade pip || true
@@ -180,12 +156,9 @@ jobs:
           export PATH="$PWD/flutter/bin:$PATH"
           python3 ci_stub_gen.py
 
-      - name: Run whitelabel build script
-        if: hashFiles('theme.json') != ''
-        run: |
-          export PATH="$PWD/flutter/bin:$PATH"
-          python3 build_whitelabel.py
-
+      # If release signing secrets are available, write keystore
+      # and update build.gradle.kts to use a release signing config.
+      # Otherwise fall back to debug keys (current state of the repo).
       - name: Configure release signing
         if: env.ANDROID_KEYSTORE_BASE64 != ''
         env:
@@ -204,11 +177,13 @@ jobs:
 
       - name: Build APK (release)
         run: |
+          export JAVA_HOME="$HOME/jdk"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter build apk --release
 
       - name: Build App Bundle (release)
         run: |
+          export JAVA_HOME="$HOME/jdk"
           export PATH="$PWD/flutter/bin:$PATH"
           flutter build appbundle --release
 
@@ -228,6 +203,8 @@ jobs:
 
 
   # ── iOS release build ───────────────────────────────────────
+  # Note: iOS builds require macOS with Xcode. We skip as a no-op
+  # on Linux runners. To enable, configure a macOS runner.
   build-ios:
     name: Build iOS Release
     runs-on: ubuntu-latest
@@ -240,7 +217,7 @@ jobs:
         run: |
           echo "INFO: iOS builds require macOS host with Xcode."
           echo "Our self-hosted runner runs Linux containers via act."
-          echo "Skipping iOS build - it will succeed as a no-op."
+          echo "Skipping iOS build — it will succeed as a no-op."
           echo "To enable iOS builds, configure a native macOS runner."