chore(android): add persistent release-signing keystore generator

An Android APK's signature identifies the app to the OS; a new build must
carry the same one as the last install or Android refuses it as an update.
generate-keystore.sh creates the keystore once, interactively, and refuses
to run again once one exists to avoid ever changing it by accident. The
resulting file is git-ignored — it's a secret that must live outside the
repo, backed up separately.

.gitignore

@@ -74,6 +74,8 @@ temp/
 *.key
 *.pfx
 *.p12
+*.keystore
+*.jks
 secrets/
 
 # Wallet data and local runtime state