fix(android): working signed release APK

- docker/android.Dockerfile: install nodejs (image ships Bun; ci-android-sign.sh
  patches build.gradle with a Node script).
- buffer polyfill: whisper.rn -> safe-buffer requires Node's `buffer`, absent in
  Metro/RN. Add `buffer` dep, alias it in metro.config.js, set the global in
  _layout. Web export unaffected (verified).

Validated locally end-to-end: assembleRelease BUILD SUCCESSFUL, 117MB APK across
all 4 ABIs with librnwhisper.so, signed (CN=Wisp, O=briggen.dev).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker/android.Dockerfile

@@ -81,6 +81,10 @@ COPY . .
 # Generate the native android/ project (autolinks whisper.rn, reanimated, etc.).
 RUN bunx expo prebuild --platform android --no-install
 
+# Node is required by scripts/ci-android-sign.sh (this image ships Bun, not Node).
+# Installed AFTER prebuild so the cached toolchain + prebuild layers are reused.
+RUN apt-get update && apt-get install -y --no-install-recommends nodejs && rm -rf /var/lib/apt/lists/*
+
 # Decode the keystore + wire release signing, then assemble the signed APK.
 # Secrets are mounted as files under /run/secrets and exported only for this RUN.
 RUN --mount=type=secret,id=ks_b64 \