security: move signing key out of source (rotated), add local replay guard

- Remove committed release keystore + hardcoded signing password - Load signing config from gitignored app/keystore.properties - Add single-use token guard (fail-open) to block on-device approval replay
2026-07-10 09:31:13 +00:00
parent 336893ffa6
commit 093ddb7fce
3 changed files with 62 additions and 6 deletions
@@ -11,3 +11,5 @@ captures/
 .cxx/
 *.keystore
 *.jks
+keystore.properties
+app/keystore.properties