ci(sonarqube): add non-blocking SonarQube analysis on push to main

Mirrors the website repo's setup: a source-based scan of app/src/main
(Kotlin) that reports to the self-hosted SonarQube server after merge,
never gating PRs. Project key runic-gateway-android-app.

Co-Authored-By: Claude <noreply@anthropic.com>

sonar-project.properties

@@ -0,0 +1,32 @@
+# SonarQube analysis config for the Android-app repo.
+# Consumed by the scanner in .gitea/workflows/sonarqube.yml on push to main.
+# The project key must match the one created in SonarQube (dashboard URL
+# ?id=runic-gateway-android-app).
+
+sonar.projectKey=runic-gateway-android-app
+sonar.projectName=runic gateway android app
+
+# Analysed application code. The single :app module's Kotlin sources.
+# SonarQube's Kotlin analyzer works on source directly, so no compiled classes
+# or Gradle build are required for the scan.
+sonar.sources=app/src/main
+
+# Local unit tests (app/src/test). Instrumented tests (app/src/androidTest) can
+# be added here once that source set exists.
+sonar.tests=app/src/test
+
+# Never analyse build output, Gradle internals, or generated code.
+sonar.exclusions=**/build/**,**/.gradle/**,**/generated/**
+
+sonar.sourceEncoding=UTF-8
+
+# ── Optional enrichment (enable once the reports are produced in CI) ──
+# For richer Kotlin/Android results, run the reporters in sonarqube.yml and point
+# SonarQube at their output:
+#   • Android Lint:  ./gradlew lintDebug   → app/build/reports/lint-results-debug.xml
+#     sonar.androidLint.reportPaths=app/build/reports/lint-results-debug.xml
+#   • JaCoCo coverage (needs a coverage-enabled test run):
+#     sonar.coverage.jacoco.xmlReportPaths=app/build/reports/jacoco/.../*.xml
+# The alternative to the CLI scanner used here is the SonarQube Gradle plugin
+# (org.sonarqube), which auto-discovers these reports; the CLI + properties file
+# is used instead to keep this repo's setup identical to website/ and link/.