feat(release): production signing in build.yml + F-Droid metadata filled

- build.yml: use production keystore (KEYSTORE_BASE64) on tag pushes,
  fall back to debug key for PRs/branch builds — build.gradle already
  reads RELEASE_STORE_FILE env var so no Gradle changes needed
- distribution/fdroid-submission/metadata.yml: filled
  AllowedAPKSigningKeys with actual SHA-256 fingerprint, commit tag
  updated to v0.3.1, version bumped to 0.3.1
- app.json: bump version 0.2.3 → 0.3.1, versionCode 1 → 2
- Add eas.json + EAS README for iOS App Store builds
- Add fastlane/metadata/android for Play Store / F-Droid graphics
- Add distribution docs: applestore, fdroid, market, playstore,
  security, threat-model, opencode-site-deploy

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/opencode-site-deploy.md

@@ -0,0 +1,60 @@
+# opencode.vibebrowser.app — Deploy Guide
+
+## Status
+
+- Vercel project: `opencode-mobile-site` (team `dzianisvs-projects`)
+- Auto-domain (live now): https://opencode-mobile-site.vercel.app
+- Custom domain (pending DNS): https://opencode.vibebrowser.app
+- Source: `/home/azureuser/workspace/vibebrowser/OpenCodeMobileSite/`
+
+## Pages deployed
+
+| Path | Purpose |
+|------|---------|
+| `/` | Landing page — download badges, features, Cloud CTA |
+| `/privacy` | Privacy policy (rendered from `distribution/privacy-policy.html`) |
+| `/terms` | Terms of service |
+| `/support` | Contact info + FAQ |
+| `/docs` | Documentation placeholder |
+
+## DNS — ACTION REQUIRED
+
+Cloudflare API token was not found (not in Bitwarden, not in env). You must
+add the DNS record manually.
+
+**Log in to Cloudflare → vibebrowser.app zone → DNS → Add record:**
+
+| Type | Name | Target | Proxy |
+|------|------|--------|-------|
+| CNAME | `opencode` | `cname.vercel-dns.com` | DNS only (orange cloud OFF) |
+
+After adding the CNAME, Vercel will automatically issue a TLS certificate.
+Verify with:
+
+```bash
+curl -sI https://opencode.vibebrowser.app/ | head -5
+```
+
+## Re-deploy
+
+```bash
+source ~/.bitwarden_credentials
+export BW_SESSION=$(BW_PASSWORD="$BW_PASSWORD" bw unlock --passwordenv BW_PASSWORD --raw)
+export VERCEL_TOKEN=$(bw get notes "VERCEL_TOKEN" --session "$BW_SESSION")
+export VERCEL_ORG_ID=team_vF4d4Phgfv1IqW1MEZw7mBre
+export VERCEL_PROJECT_ID=prj_Gy68vPhrgN0wEpFtxrCKUX38whLh
+cd /home/azureuser/workspace/vibebrowser/OpenCodeMobileSite
+vercel deploy --prod --yes --token "$VERCEL_TOKEN"
+```
+
+## Privacy policy sync
+
+The `/privacy` page reads `../../../opencode-mobile/distribution/privacy-policy.html`
+at build time (relative to the Next.js project root, resolved server-side).
+When the privacy policy changes, re-deploy the site to pick up the new version.
+
+## Verification command
+
+```bash
+curl -sI https://opencode.vibebrowser.app/privacy | head -3
+```