Cascade v0.2.3-android (Android)

android: production release signing + Android App Links; v0.2.3

- Add a release signingConfig driven by env vars (set from repo secrets in CI),
  with a debug-signing fallback so local release builds still work. The release
  workflow now decodes the keystore from ANDROID_KEYSTORE_BASE64 and signs with
  the production key.
- Publish /.well-known/assetlinks.json (apps/web/public) pinning the app package
  + the release key's SHA-256 fingerprint, so the autoVerify intent-filter on
  https://cascade.stephens.page/auth makes the emailed magic link open the app
  directly (App Links), not the browser. The paste-link fallback stays as a
  belt-and-suspenders path.

Bumps to 0.2.3 / versionCode 5.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>