Fix empty usage-history chart + externalize signing secrets

History chart: recordHistory() threw away the previous point whenever a
new reading landed within the 2-min de-dup window, but the foreground loop
refreshes every 30s — so history could never grow past one point while the
app was open and the chart stayed stuck on 'Collecting history…'. Now it
throttles by SKIPPING a too-soon reading instead of replacing the last one,
so points accumulate during normal use.

Security:
- Remove hardcoded release keystore passwords from build.gradle.kts; read
  from env vars / gitignored keystore.properties; CI injects from Gitea
  secrets (KEYSTORE_PASSWORD/KEY_PASSWORD). Signing identity unchanged.
- Make the cookie-never-plaintext invariant explicit on the read path.
- Drop custom ACTION_REFRESH from the exported widget intent-filter so other
  apps can't trigger refreshes; internal explicit PendingIntent still works.
- Gate an unguarded Log.w behind BuildConfig.DEBUG.

keystore.properties.example

@@ -0,0 +1,12 @@
+# Release signing credentials for local builds.
+# Copy to `keystore.properties` (which is gitignored) and fill in the real values.
+# These are NEVER committed. CI injects the same values from Gitea Actions secrets.
+#
+#   cp keystore.properties.example keystore.properties
+#
+# The keystore file itself (app/claude-widget-release.keystore) is also gitignored.
+# Signing identity is unchanged from older builds — same keystore, same alias.
+
+storePassword=CHANGE_ME
+keyPassword=CHANGE_ME
+keyAlias=claudewidget