chore(ci): use persistent keystore for staging Android builds

[masch]

Problem

The Android staging builds (deploy-mobile-android-staging.yml) currently compile preview APKs without a fixed keystore, causing Gradle to generate an ephemeral debug keystore on each CI run.

This causes two issues:

1. The SHA-256 signing fingerprint changes on every CI build, making it impossible to register a static package signature in Android Developer Verification (Google Play Console) for org.masch.sonora.staging.app.
2. Testers on Firebase App Distribution must uninstall the existing app before installing new staging builds because the signing key changes across builds.

Proposed Solution

1. Generate a dedicated staging keystore (sonora-staging-keystore.jks).
2. Store the base64-encoded keystore and passwords in GitHub Actions staging secrets (e.g., STAGING_KEYSTORE_BASE64, STAGING_KEYSTORE_PASSWORD, STAGING_KEY_PASSWORD).
3. Update apps/mobile/eas.json and .github/workflows/deploy-mobile-android-staging.yml to write the staging keystore and build signed staging APKs deterministically.