Fix R8 dontwarn rules, WorkManager init, and release signing config

- Add dontwarn for errorprone annotations (Tink) and sun.security.x509
- Remove WorkManagerInitializer from manifest (app uses on-demand init)
- Wire signingConfigs.release from local.properties

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/build.gradle.kts

@@ -13,6 +13,11 @@ val versionProps = Properties().apply {
     load(rootProject.file("version.properties").inputStream())
 }
 
+val localProps = Properties().apply {
+    val f = rootProject.file("local.properties")
+    if (f.exists()) load(f.inputStream())
+}
+
 android {
     namespace = "com.syncflow"
     compileSdk = 34
@@ -31,11 +36,21 @@ android {
         manifestPlaceholders["MSAL_REDIRECT_URI"] = "msauth://com.syncflow/YOUR_BASE64_SIGNATURE"
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = localProps["KEYSTORE_PATH"]?.toString()?.let { file(it) }
+            storePassword = localProps["KEYSTORE_PASSWORD"]?.toString()
+            keyAlias = localProps["KEY_ALIAS"]?.toString()
+            keyPassword = localProps["KEY_PASSWORD"]?.toString()
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            signingConfig = signingConfigs.getByName("release")
         }
     }