feat(release): target API 36 and upload each tag's bundle to Google Play

Step 1 of M8 (docs/android/PLAN.md item 9).

- compileSdk/targetSdk 36 (Play's floor since 2026-08-31). AGP 8.6.1
  cannot build against 36, so AGP goes to 8.13.2 (the last 8.x) with the
  Gradle 8.14.3 wrapper. Kotlin, KSP and Hilt are unchanged. All three
  workflows install platforms;android-36; AGP 8.13 still defaults to
  build-tools 35.0.0.
- release.yml also runs bundleRelease, signed with the same keystore,
  and attaches the .aab to the Gitea release beside the APK (the first
  bundle has to be uploaded by hand, and this is where it comes from).
- A last step uploads the bundle to Play's internal track through the
  Play Developer API v3 edit flow. The OAuth token comes from a
  service-account JWT signed with openssl; the key is the new
  PLAY_SERVICE_ACCOUNT_JSON secret. While that secret is unset, the
  step warns and skips. The step runs after the Gitea release, so a
  Play failure never holds back the APK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

app/build.gradle.kts

@@ -38,13 +38,13 @@ val hasReleaseSigning = ksStoreFilePath != null && ksStorePassword != null &&
 
 android {
     namespace = "com.runicgateway.app"
-    compileSdk = 35
+    compileSdk = 36
 
     defaultConfig {
         // Target application id per docs/android/PLAN.md §13 (pending runicgateway.app domain).
         applicationId = "com.runicgateway.app"
         minSdk = 29
-        targetSdk = 35
+        targetSdk = 36
         // These committed defaults are the version source of truth (PLAN.md §10).
         // release.yml's conventional-commit engine bumps versionName here and commits
         // it on release; versionCode is derived from it (major*10000+minor*100+patch)

app/src/main/res/xml/network_security_config.xml

@@ -3,7 +3,7 @@
 <!--
   The app is purely an HTTPS API client of a shard's website backend, so the base
   posture forbids all cleartext (HTTP) traffic. This makes explicit what minSdk 29 /
-  targetSdk 35 already default to, satisfies the "usesCleartextTraffic implicitly
+  targetSdk 36 already default to, satisfies the "usesCleartextTraffic implicitly
   enabled" scanner finding, and stops any merged library manifest from re-enabling
   cleartext. It also mirrors ServerUrl's release-build rule (HTTPS required) at the
   platform socket layer — defense in depth.