ci: integrate iOS and Android stages with Gitea-native syntax

- Replace github.* context vars with gitea.* equivalents
- Change iOS runner from macos-latest to self-hosted (available on our runner)
- Fix release.yml: hardcoded '***' token -> actual $GITEA_TOKEN secret
- Fix release.yml: missing AAB upload step (only APK was uploaded)
- Consistent format gate: ci.yml uses --fix, release.yml uses --set-exit-if-changed
- Keep lint -> test -> build pipeline gate chain

.gitea/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
 
 # Cancel in-progress runs on new push to same branch
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 env:
@@ -72,11 +72,11 @@ jobs:
         run: flutter test --reporter=expanded
 
       - name: Run tests with coverage
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         run: flutter test --coverage
 
       - name: Upload coverage report
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
@@ -189,9 +189,12 @@ jobs:
 
 
   # ── Stage 3 (parallel): iOS build ───────────────────────────────
+  # Note: requires a macOS runner. Uses 'self-hosted' label which
+  # matches our Gitea Actions runner. Falls back to --no-codesign
+  # if Apple signing secrets are not configured.
   build-ios:
     name: Build iOS
-    runs-on: macos-latest
+    runs-on: self-hosted
     needs: [test]
     steps:
       - name: Checkout

.gitea/workflows/release.yml

@@ -159,9 +159,12 @@ jobs:
 
 
   # ── iOS release build ───────────────────────────────────────
+  # Note: requires a macOS runner. Uses 'self-hosted' label which
+  # matches our Gitea Actions runner. Falls back to --no-codesign
+  # if Apple signing secrets are not configured.
   build-ios:
     name: Build iOS Release
-    runs-on: macos-latest
+    runs-on: self-hosted
     needs: [test]
     steps:
       - name: Checkout
@@ -240,7 +243,7 @@ jobs:
       - name: Create Gitea Release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ gitea.ref_name }}
           GITEA_BASE: https://git.westerntechnologies.duckdns.org
         run: |
           curl -s -X POST \
@@ -252,7 +255,7 @@ jobs:
       - name: Upload APK to Release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          TAG: ${{ github.ref_name }}
+          TAG: ${{ gitea.ref_name }}
           GITEA_BASE: https://git.westerntechnologies.duckdns.org
         run: |
           curl -s -X POST \
@@ -260,3 +263,15 @@ jobs:
             -H "Content-Type: application/vnd.android.package-archive" \
             --data-binary @app-release.apk \
             "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.apk&tag_name=$TAG"
+
+      - name: Upload AAB to Release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          TAG: ${{ gitea.ref_name }}
+          GITEA_BASE: https://git.westerntechnologies.duckdns.org
+        run: |
+          curl -s -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @app-release.aab \
+            "$GITEA_BASE/api/v1/repos/kfj001/kryz-go-flutter/releases/assets?name=app-release.aab&tag_name=$TAG"