feat: CI creates Gitea releases with changelog, app polls for updates on startup

- android-build.yml: fetch full history+tags, embed VITE_APP_BUILD, add step
  to create a tagged Gitea release (build-N) with markdown changelog and APK
  release assets after every push; bump permissions to contents:write
- src/game/update-check.ts: polls Gitea releases/latest, compares build-N tag
  against CURRENT_BUILD (0 in dev), returns UpdateInfo or null; dismissal
  persisted to localStorage
- src/vite-env.d.ts: TypeScript env declarations for VITE_APP_BUILD
- src/scenes/MenuScene.ts: fire-and-forget update check on menu load; renders
  dismissible bottom-bar banner with optional APK download link
- src/game/ai.ts: early-game empty-table dump heuristic (safest card first)

.gitea/workflows/android-build.yml

@@ -5,7 +5,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  contents: write   # required for creating releases
   packages: write
 
 jobs:
@@ -16,6 +16,9 @@ jobs:
       # ── 1. Source ────────────────────────────────────────────────────────────
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          # Full history + tags required for the changelog step.
+          fetch-depth: 0
 
       # ── 2. Java ──────────────────────────────────────────────────────────────
       - name: Set up JDK 21
@@ -75,6 +78,10 @@ jobs:
         run: npm ci
 
       - name: Build web assets
+        env:
+          # Embed the CI run number as the app's build identifier so the
+          # in-app update check can compare against Gitea release tags.
+          VITE_APP_BUILD: ${{ github.run_number }}
         run: npm run build
 
       # ── 7. Capacitor sync ────────────────────────────────────────────────────
@@ -136,3 +143,50 @@ jobs:
                  app-release-unsigned.apk
 
           echo "📦 Package index: $BASE/$VERSION/"
+
+      # ── 11. Create a Gitea release and attach the APKs ───────────────────────
+      # Requires PACKAGE_TOKEN to have both write:package AND write:repository
+      # scopes.  If the PAT lacks write:repository the curl will return 403 and
+      # the step will fail — update the PAT scopes on the Gitea web UI.
+      - name: Create Gitea release
+        env:
+          TOKEN: ${{ secrets.PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${{ github.run_number }}"
+          TAG="build-${VERSION}"
+          API="https://git.sal.giize.com/api/v1/repos/mozempk/scopone"
+
+          # ── Changelog: commits since last build-* tag (or last 30 commits) ──
+          LAST_TAG=$(git tag --sort=-creatordate | grep -E '^build-[0-9]+$' | head -1 || true)
+          if [[ -n "$LAST_TAG" ]]; then
+            COMMIT_LOG=$(git log --oneline "${LAST_TAG}..HEAD" 2>/dev/null || git log --oneline | head -30)
+          else
+            COMMIT_LOG=$(git log --oneline | head -30)
+          fi
+          # Format as a markdown list and JSON-encode for the API body.
+          MD_LIST=$(echo "$COMMIT_LOG" | sed 's/^/- /')
+          BODY=$(printf '%s' "$MD_LIST" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))")
+
+          # ── Create the release ───────────────────────────────────────────────
+          RESP=$(curl -sf -X POST "$API/releases" \
+            -H "Authorization: token $TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"Build $VERSION\",\"body\":$BODY,\"draft\":false,\"prerelease\":false}")
+          RELEASE_ID=$(echo "$RESP" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+          echo "Created release $TAG (id=$RELEASE_ID)"
+
+          # ── Upload APKs as release assets ────────────────────────────────────
+          upload_asset() {
+            local file="$1" name="$2"
+            HTTP=$(curl -sf -o /dev/null -w "%{http_code}" \
+              -X POST "$API/releases/$RELEASE_ID/assets?name=${name}" \
+              -H "Authorization: token $TOKEN" \
+              -H "Content-Type: application/octet-stream" \
+              --data-binary "@$file")
+            echo "  $name → HTTP $HTTP"
+            [[ "$HTTP" == "20"* ]] || { echo "✗ asset upload failed"; exit 1; }
+          }
+          upload_asset android/app/build/outputs/apk/release/app-release-unsigned.apk app-release-unsigned.apk
+          upload_asset android/app/build/outputs/apk/debug/app-debug.apk app-debug.apk
+          echo "🚀 https://git.sal.giize.com/mozempk/scopone/releases/tag/$TAG"