ci(apk): arm64-only, tag-triggered, persistent /wisp.apk via host mount

- android.Dockerfile: build arm64-v8a only (--max-workers=2) → ~48MB APK, ~4x
  less compile (the 4-ABI build timed out on the shared prod runner).
- ci.yml: build-apk runs only on version tags (v*), timeout 120m — normal pushes
  no longer peg the box; web still auto-deploys on every master push.
- wisp.compose.yml: mount /srv/wisp/wisp.apk read-only so the download survives
  web container rebuilds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/android.Dockerfile

@@ -97,7 +97,9 @@ RUN --mount=type=secret,id=ks_b64 \
     ANDROID_KEY_PASSWORD="$(cat /run/secrets/ks_keypass)" \
     bash scripts/ci-android-sign.sh \
     && cd android \
-    && ./gradlew assembleRelease --no-daemon -x lint --stacktrace
+    && ./gradlew assembleRelease \
+        -PreactNativeArchitectures=arm64-v8a \
+        --no-daemon --max-workers=2 -x lint --stacktrace
 
 # The signed APK (handy for `docker create` + `docker cp` extraction in CI).
 # /workspace/android/app/build/outputs/apk/release/app-release.apk