feat(ci): add EAS build + auto-submit release workflow for main

On push to main (with a manual approval gate via the production
environment), cloud-build and auto-submit iOS, tvOS and Android in
parallel:
- iOS: EAS-remote credentials, App Store Connect API key via EXPO_ASC_* env
- tvOS: local credentials.json + cert/profiles restored from secrets
- Android: AAB submitted with a Google Play service account key

Also adds the android submit profile in eas.json and ignores the
CI-injected google-service-account.json.

eas.json

@@ -93,6 +93,11 @@
       "ios": {
         "appleTeamId": "MWD5K362T8",
         "ascAppId": "6593660679"
+      },
+      "android": {
+        "serviceAccountKeyPath": "./google-service-account.json",
+        "track": "internal",
+        "releaseStatus": "completed"
       }
     },
     "production_tv": {