ci: integrate iOS and Android stages with Gitea-native syntax

- Replace github.* context vars with gitea.* equivalents
- Change iOS runner from macos-latest to self-hosted (available on our runner)
- Fix release.yml: hardcoded '***' token -> actual $GITEA_TOKEN secret
- Fix release.yml: missing AAB upload step (only APK was uploaded)
- Consistent format gate: ci.yml uses --fix, release.yml uses --set-exit-if-changed
- Keep lint -> test -> build pipeline gate chain

.gitea/workflows/ci.yml

@@ -12,7 +12,7 @@ on:
 
 # Cancel in-progress runs on new push to same branch
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 env:
@@ -72,11 +72,11 @@ jobs:
         run: flutter test --reporter=expanded
 
       - name: Run tests with coverage
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         run: flutter test --coverage
 
       - name: Upload coverage report
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        if: gitea.ref == 'refs/heads/main' && gitea.event_name == 'push'
         uses: actions/upload-artifact@v4
         with:
           name: coverage-report
@@ -189,9 +189,12 @@ jobs:
 
 
   # ── Stage 3 (parallel): iOS build ───────────────────────────────
+  # Note: requires a macOS runner. Uses 'self-hosted' label which
+  # matches our Gitea Actions runner. Falls back to --no-codesign
+  # if Apple signing secrets are not configured.
   build-ios:
     name: Build iOS
-    runs-on: macos-latest
+    runs-on: self-hosted
     needs: [test]
     steps:
       - name: Checkout