CI: skip TLS verify on iOS artifact upload + verbose AAB build

iOS:
- Build itself succeeds (Runner.app sits in build/ios/iphonesimulator/).
- actions/upload-artifact's Node.js HTTP client hits git.such.software
  via LAN (NAT hairpin), bypassing the public NPM/Let's Encrypt cert
  and landing on Gitea's internal self-signed cert. Node refuses with
  DEPTH_ZERO_SELF_SIGNED_CERT.
- Setting NODE_TLS_REJECT_UNAUTHORIZED=0 at job env disables verification
  for all Node-based actions in the job. Acceptable here because we're
  talking to our own server on our own LAN — no external MITM surface.
- Long-term cleaner fix: install Gitea's CA cert into the runner's
  system trust store, or have the runner reach Gitea via the public
  hostname so NPM's Let's Encrypt cert is presented.

Android AAB:
- APK built + signed + uploaded fine (~14 min). AAB build then failed
  at FinalizeBundleTask$BundleToolRunnable / :app:signReleaseBundle
  with no visible error.
- Added --verbose to 'flutter build appbundle' so the next run prints
  the actual gradle stacktrace. Once we see WHY signReleaseBundle is
  failing, we can target the real fix.

.github/workflows/build-android.yml

@@ -237,9 +237,11 @@ jobs:
         run: flutter build apk --dart-define-from-file=env.json --release
 
       # AAB for Play Console upload (Google generates per-ABI APKs server-side
-      # via Play App Signing).
+      # via Play App Signing). --verbose surfaces the full gradle stacktrace
+      # when FinalizeBundleTask / signReleaseBundle fails — without it the
+      # error is opaque ('FinalizeBundleTask$BundleToolRunnable failed').
       - name: Build release AAB
-        run: flutter build appbundle --dart-define-from-file=env.json --release
+        run: flutter build appbundle --dart-define-from-file=env.json --release --verbose
 
       - name: Sanity-check signature on APK
         run: |

.github/workflows/build-ios-sim.yml

@@ -32,6 +32,14 @@ jobs:
       # Gitea runner shell). Force UTF-8 globally so `pod install` succeeds.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # The Mac runner hits git.such.software via the LAN (NAT hairpin),
+      # which bypasses the Let's Encrypt-fronted NPM and lands on Gitea's
+      # internal self-signed cert. Node won't trust it, so artifact upload
+      # bails with DEPTH_ZERO_SELF_SIGNED_CERT. Acceptable to skip
+      # validation since we're talking to our own infrastructure on our LAN.
+      # Long-term fix: point the runner at git.such.software via the public
+      # IP / NPM cert OR install Gitea's CA into the runner's trust store.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/build-ios-testflight.yml

@@ -38,6 +38,10 @@ jobs:
       # CocoaPods needs UTF-8; Gitea runner shell defaults to ASCII-8BIT.
       LANG: en_US.UTF-8
       LC_ALL: en_US.UTF-8
+      # Mac runner hits internal Gitea over LAN (NAT hairpin), bypassing
+      # the public Let's Encrypt cert. Skip TLS verification for the
+      # artifact upload — talking to our own server on our own network.
+      NODE_TLS_REJECT_UNAUTHORIZED: '0'
 
     steps:
       - uses: actions/checkout@v4