ci: publish APK to GitHub release on v* tag

Adds a publish-release job that triggers only on tag pushes (refs/tags/v*).
It reuses the APK artifact uploaded by apk-deploy, publishes a GitHub
release via softprops/action-gh-release, and attaches the APK.

Result: a stable permalink to the latest APK at
  https://github.com/<owner>/<repo>/releases/latest/download/PostIt.Android.apk

.github/workflows/docker-publish-android.yml

@@ -4,8 +4,15 @@ on:
   push:
     branches:
       - main
+    tags:
+      - 'v*'
   workflow_dispatch:
 
+# softprops/action-gh-release a besoin de contents: write
+# pour publier une release + uploader un asset.
+permissions:
+  contents: write
+
 jobs:
   apk-deploy:
     runs-on: ubuntu-latest
@@ -34,3 +41,27 @@ jobs:
           path: ./PostIt.Android.apk
           retention-days: 7
 
+  publish-release:
+    # Uniquement déclenché par un tag v*. Le job apk-deploy tourne en
+    # parallèle, on partage l'artefact entre jobs.
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: apk-deploy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Récupérer l'APK depuis l'artefact
+        uses: actions/download-artifact@v7
+        with:
+          name: application-apk-release
+          path: ./
+
+      - name: Publier la release GitHub et uploader l'APK
+        uses: softprops/action-gh-release@v2
+        with:
+          # Le nom de fichier final dans la release. C'est ce qui
+          # apparaîtra dans l'asset et donc dans le permalink :
+          #   https://github.com/<owner>/<repo>/releases/latest/download/PostIt.Android.apk
+          files: ./PostIt.Android.apk
+          # generate_release_notes: true -> évite d'avoir à maintenir
+          # le corps de release à la main. Décommente si tu veux.
+          # generate_release_notes: true
+