feat: enable Play Store CI deploy via Google Play API

- Add ndk debugSymbolLevel=FULL to release build type (opt-B for debug symbols)
- Add google-api-python-client to Nix devshell
- Add scripts/deploy_playstore.py to upload AAB to internal track
- Add deploy-android-bundle task to Taskfile
- Enable release.yml (remove if:false, wire up task deploy-android-bundle)
- Fix forbidden-files pre-commit hook to run task via nix develop (like dart-check)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/deploy_playstore.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Upload an Android App Bundle to the Google Play Store internal track."""
+
+import json
+import os
+import sys
+
+from google.oauth2 import service_account
+from googleapiclient.discovery import build
+from googleapiclient.http import MediaFileUpload
+
+PACKAGE_NAME = "de.sharedinbox.mua"
+AAB_PATH = "build/app/outputs/bundle/release/app-release.aab"
+TRACK = "internal"
+
+
+def main():
+    config_json = os.environ.get("PLAY_STORE_CONFIG_JSON")
+    if not config_json:
+        print("Error: PLAY_STORE_CONFIG_JSON environment variable not set", file=sys.stderr)
+        sys.exit(1)
+
+    if not os.path.exists(AAB_PATH):
+        print(f"Error: AAB not found at {AAB_PATH}", file=sys.stderr)
+        sys.exit(1)
+
+    creds = service_account.Credentials.from_service_account_info(
+        json.loads(config_json),
+        scopes=["https://www.googleapis.com/auth/androidpublisher"],
+    )
+
+    service = build("androidpublisher", "v3", credentials=creds)
+
+    edit = service.edits().insert(body={}, packageName=PACKAGE_NAME).execute()
+    edit_id = edit["id"]
+
+    media = MediaFileUpload(AAB_PATH, mimetype="application/octet-stream", resumable=True)
+    bundle = (
+        service.edits()
+        .bundles()
+        .upload(packageName=PACKAGE_NAME, editId=edit_id, media_body=media)
+        .execute()
+    )
+    version_code = bundle["versionCode"]
+    print(f"Uploaded AAB, version code: {version_code}")
+
+    service.edits().tracks().update(
+        packageName=PACKAGE_NAME,
+        editId=edit_id,
+        track=TRACK,
+        body={"releases": [{"versionCodes": [version_code], "status": "completed"}]},
+    ).execute()
+
+    service.edits().commit(packageName=PACKAGE_NAME, editId=edit_id).execute()
+    print(f"Deployed version {version_code} to {TRACK} track")
+
+
+if __name__ == "__main__":
+    main()