ci(apk): arm64-only, tag-triggered, persistent /wisp.apk via host mount

- android.Dockerfile: build arm64-v8a only (--max-workers=2) → ~48MB APK, ~4x
  less compile (the 4-ABI build timed out on the shared prod runner).
- ci.yml: build-apk runs only on version tags (v*), timeout 120m — normal pushes
  no longer peg the box; web still auto-deploys on every master push.
- wisp.compose.yml: mount /srv/wisp/wisp.apk read-only so the download survives
  web container rebuilds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/wisp.compose.yml

@@ -27,6 +27,12 @@ services:
       - "traefik.http.routers.wisp.entrypoints=websecure"
       - "traefik.http.routers.wisp.tls.certresolver=letsencrypt"
       - "traefik.http.services.wisp.loadbalancer.server.port=8080"
+    # The downloadable Android APK, published to the host by the build-apk CI job
+    # (or a local build). Mounted read-only so it survives web container rebuilds.
+    # NOTE: /srv/wisp/wisp.apk must exist on the host before `up` (else Docker
+    # creates a directory there). The publish step creates it.
+    volumes:
+      - /srv/wisp/wisp.apk:/usr/share/nginx/html/wisp.apk:ro
     networks:
       - proxy