me-web? 0.15.1: the F-Droid repository is signed with the app's own key

- The Arasaka F-Droid repository, packages.arasaka.software/fdroid/repo, is signed with the same key as the app, so
  the fingerprint F-Droid or Obtainium checks is the one already on the download page for the APK.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T9uhaCTSycTh1r8At679Pz

CLAUDE.md

@@ -177,13 +177,14 @@ The Android release key: alias `meweb`, certificate SHA-256
   release is published, so the repository can lag the release page but never lead it. `.gitea/scripts/fdroid.sh`
   installs fdroidserver into `tools/fdroid` (cached like the JDK) with uv from `setup.json` and the hash-locked
   `packaging/fdroid/requirements.txt`, because the box has no `ensurepip` and the apt package would bring 242 others.
-  It refuses any repository key but `42C47659…BD0374` (org secrets `FDROID_KEYSTORE_B64` and `FDROID_KEYSTORE_PASS`;
-  the only other copy is the owner's Nextcloud, `Backups/arasaka-fdroid-repo-key/`), builds a new snapshot in
+  It signs the repository with the APK's own key (`MEWEB_KEYSTORE_B64` and `MEWEB_KEYSTORE_PASS`, alias `meweb`), so
+  the F-Droid fingerprint is the certificate's `5F52CFF4…FDF846` and there is no second key to lose; it refuses any
+  other. It builds a new snapshot in
   `/var/www/packages.arasaka.software/.fdroid/` from the live one (the APKs as hard links, so `rm` then `cp` as above;
   the metadata, `apkcache.json` and the previous `index-v2.json`, which is where fdroidserver reads each APK's first
   date), adds this version, keeps the newest three, runs `fdroid update`, deletes `repo/status/` (it names the
-  build machine's paths and `/etc/issue.net`), swaps the `fdroid/repo` link and checks the live signature. Never
-  regenerate the key: everyone who added the repository trusts only its fingerprint. `packaging/fdroid/` holds the
+  build machine's paths and `/etc/issue.net`), swaps the `fdroid/repo` link and checks the live signature. The key
+  was already never to be regenerated; now everyone who added the repository trusts only its fingerprint too. `packaging/fdroid/` holds the
   repository's settings, its icon (the Arasaka emblem) and the app's listing in English and Italian; the download
   page links to it and to Obtainium (`Endpoints.FDroid`, source `FDroidRepo`).
 - **The server cannot ping**: `NoNewPrivileges` drops `ping`'s file capability and `ping_group_range` is closed, so