Add Forgejo Actions release workflow for Obtainium APK updates.

Build a signed Flutter APK on desktop-release and publish versioned assets so private-repo Obtainium can track frosty-arm64-v8a-v*.apk.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/OBTAINIUM.md

@@ -0,0 +1,45 @@
+# Obtainium (Android)
+
+Forgejo fork: [copilot/frosty](https://forgejo.fsociety00.cc/copilot/frosty) (**private**).
+
+Releases: `.forgejo/workflows/release.yml` on runner `desktop-release` (tag `v*` or workflow_dispatch).
+
+## Obtainium settings
+
+| Setting | Value |
+|---|---|
+| Source | Forgejo |
+| URL | `https://forgejo.fsociety00.cc/api/v1/repos/copilot/frosty/releases` |
+| APK filter | `frosty-arm64-v8a-v.*\.apk` |
+| Trim version | `v?([0-9]+\.[0-9]+\.[0-9]+)` |
+| Match group | `1` |
+
+Repo is private → add a Forgejo API token in Obtainium (same PAT as other Newas apps).
+
+Quick add:
+
+```text
+obtainium://add/https://forgejo.fsociety00.cc/api/v1/repos/copilot/frosty/releases
+```
+
+## Signing / Play Store conflict
+
+Package id stays `com.tommychow.frosty`. Play Store Frosty and this fork use **different signing keys**, so Obtainium cannot update stock → fork in place. Uninstall the Play build first, then install from Obtainium.
+
+## CI secrets (Forgejo repo)
+
+| Secret | Purpose |
+|---|---|
+| `RELEASE_KEYSTORE_BASE64` | Same pattern as Flow / Finamp / Jellyfin forks |
+| `STORE_PASSWORD` | Keystore password |
+| `KEY_ALIAS` | Key alias |
+| `KEY_PASSWORD` | Key password |
+| `CLIENT_ID` | Twitch Helix app client id (`--dart-define`) |
+| `SECRET` | Twitch Helix app secret (`--dart-define`) |
+
+## Cut a release
+
+1. Bump `version:` in `pubspec.yaml` (`x.y.z+build`) if needed.
+2. Tag and push: `git tag vX.Y.Z && git push origin vX.Y.Z`  
+   or run **Actions → Release APK → Run workflow**.
+3. Install / update via Obtainium once the release asset appears.