feat(background): implement user consent mechanism for auto-start functionality

Add auto-start consent system that requires explicit user permission before enabling background sync services. Users can now choose between silent mode (no auto-start) or background mode (15-minute sync intervals).

- Add consent service with AutoStartMode enum and storage utilities
- Create withRemoveAutoStart Expo plugin to disable Android auto-start defaults
- Integrate consent checks into JPush service, background task manager, and foreground service
- Add auto-start consent UI in notification settings with descriptive dialog
- Update privacy policy with section 8 explaining auto-start scenarios and user controls
- Change default sync mode from BATTERY_SAVER to DISABLED
- Export reinitBackgroundService function for re-initializing after consent changes
- Merge OTA Android and iOS workflows into matrix build
- Add release signing config in withSigning plugin for Android
- Expand .dockerignore with native credential and build artifact exclusions

.gitea/workflows/build.yml

@@ -21,17 +21,18 @@ on:
 env:
   REGISTRY: code.littlelan.cn
   IMAGE_NAME: carrot_bbs/frontend-web
-  OTA_PLATFORM_ANDROID: android
-  OTA_PLATFORM_IOS: ios
   OTA_PUBLISH_URL: https://updates.littlelan.cn/admin/publish
   OTA_MANIFEST_URL: https://updates.littlelan.cn/api/manifest
 
 jobs:
-  ota-android:
+  ota:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || github.event.inputs.publish_ota == 'true')
     permissions:
       contents: read
+    strategy:
+      matrix:
+        platform: [android, ios]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -41,12 +42,7 @@ jobs:
         with:
           node-version: '25.6.1'
           registry-url: 'https://registry.npmmirror.com'
-
-      - name: Remove deprecated always-auth npm config
-        run: |
-          if [ -f ~/.npmrc ]; then
-            sed -i '/always-auth/d' ~/.npmrc
-          fi
+          cache: 'npm'
 
       - name: Install dependencies
         run: npm ci
@@ -58,117 +54,44 @@ jobs:
           echo "runtime_version=${RUNTIME_VERSION}" >> "$GITHUB_OUTPUT"
           echo "Resolved runtimeVersion: ${RUNTIME_VERSION}"
 
-      - name: Export Android update bundle
+      - name: Export update bundle
         run: |
-          rm -rf dist-android dist-android-update.zip
-          npx expo export --platform android --output-dir dist-android
-          npx expo config --type public --json > dist-android/expoConfig.json
+          rm -rf dist-${{ matrix.platform }} dist-${{ matrix.platform }}-update.zip
+          npx expo export --platform ${{ matrix.platform }} --output-dir dist-${{ matrix.platform }}
+          npx expo config --type public --json > dist-${{ matrix.platform }}/expoConfig.json
 
-      - name: Archive Android update bundle
+      - name: Archive update bundle
         run: |
-          python - <<'PY'
-          import os
-          import zipfile
-
-          with zipfile.ZipFile('dist-android-update.zip', 'w', zipfile.ZIP_DEFLATED) as zf:
-              for root, _, files in os.walk('dist-android'):
+          python -c "
+          import os, zipfile
+          p = '${{ matrix.platform }}'
+          dist = f'dist-{p}'
+          with zipfile.ZipFile(f'dist-{p}-update.zip', 'w', zipfile.ZIP_DEFLATED) as zf:
+              for root, _, files in os.walk(dist):
                   for name in files:
                       src = os.path.join(root, name)
-                      arc = os.path.relpath(src, 'dist-android')
+                      arc = os.path.relpath(src, dist)
                       zf.write(src, arc)
-          PY
+          "
 
       - name: Publish OTA
         env:
           OTA_AUTH_TOKEN: ${{ secrets.OTA_AUTH_TOKEN }}
         run: |
           test -n "${OTA_AUTH_TOKEN}" || (echo "Missing secret OTA_AUTH_TOKEN" && exit 1)
-          curl -fSs -X POST "${OTA_PUBLISH_URL}?runtimeVersion=${{ steps.runtime.outputs.runtime_version }}&platform=${OTA_PLATFORM_ANDROID}" \
+          curl -fSs -X POST "${OTA_PUBLISH_URL}?runtimeVersion=${{ steps.runtime.outputs.runtime_version }}&platform=${{ matrix.platform }}" \
             -H "Authorization: Bearer ${OTA_AUTH_TOKEN}" \
             -H "Content-Type: application/zip" \
-            --data-binary @"dist-android-update.zip"
+            --data-binary @"dist-${{ matrix.platform }}-update.zip"
 
       - name: Verify OTA manifest
         run: |
           REMOTE="$(curl -sS "${OTA_MANIFEST_URL}" \
-            -H "expo-platform: ${OTA_PLATFORM_ANDROID}" \
-            -H "expo-runtime-version: ${{ steps.runtime.outputs.runtime_version }}" \
-            -H "expo-protocol-version: 1" \
-            | python -c "import sys, json, re; s=sys.stdin.read(); m=re.search(r'\\{\\\"id\\\":.*\\\"extra\\\":\\{.*\\}\\}', s); j=json.loads(m.group(0)); print(j['launchAsset']['url'].split('/')[-1].split('&')[0])")"
-          LOCAL="$(python -c "import json; m=json.load(open('dist-android/metadata.json')); print(m['fileMetadata']['android']['bundle'].split('/')[-1])")"
-          echo "Remote bundle: ${REMOTE}"
-          echo "Local bundle:  ${LOCAL}"
-          test "${REMOTE}" = "${LOCAL}"
-
-  ota-ios:
-    runs-on: ubuntu-latest
-    if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || github.event.inputs.publish_ota == 'true')
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: '25.6.1'
-          registry-url: 'https://registry.npmmirror.com'
-
-      - name: Remove deprecated always-auth npm config
-        run: |
-          if [ -f ~/.npmrc ]; then
-            sed -i '/always-auth/d' ~/.npmrc
-          fi
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Resolve runtime version
-        id: runtime
-        run: |
-          RUNTIME_VERSION="$(node -p "require('./app.json').expo.version")"
-          echo "runtime_version=${RUNTIME_VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Resolved runtimeVersion: ${RUNTIME_VERSION}"
-
-      - name: Export iOS update bundle
-        run: |
-          rm -rf dist-ios dist-ios-update.zip
-          npx expo export --platform ios --output-dir dist-ios
-          npx expo config --type public --json > dist-ios/expoConfig.json
-
-      - name: Archive iOS update bundle
-        run: |
-          python - <<'PY'
-          import os
-          import zipfile
-
-          with zipfile.ZipFile('dist-ios-update.zip', 'w', zipfile.ZIP_DEFLATED) as zf:
-              for root, _, files in os.walk('dist-ios'):
-                  for name in files:
-                      src = os.path.join(root, name)
-                      arc = os.path.relpath(src, 'dist-ios')
-                      zf.write(src, arc)
-          PY
-
-      - name: Publish OTA
-        env:
-          OTA_AUTH_TOKEN: ${{ secrets.OTA_AUTH_TOKEN }}
-        run: |
-          test -n "${OTA_AUTH_TOKEN}" || (echo "Missing secret OTA_AUTH_TOKEN" && exit 1)
-          curl -fSs -X POST "${OTA_PUBLISH_URL}?runtimeVersion=${{ steps.runtime.outputs.runtime_version }}&platform=${OTA_PLATFORM_IOS}" \
-            -H "Authorization: Bearer ${OTA_AUTH_TOKEN}" \
-            -H "Content-Type: application/zip" \
-            --data-binary @"dist-ios-update.zip"
-
-      - name: Verify OTA manifest
-        run: |
-          REMOTE="$(curl -sS "${OTA_MANIFEST_URL}" \
-            -H "expo-platform: ${OTA_PLATFORM_IOS}" \
+            -H "expo-platform: ${{ matrix.platform }}" \
             -H "expo-runtime-version: ${{ steps.runtime.outputs.runtime_version }}" \
             -H "expo-protocol-version: 1" \
             | python -c "import sys, json, re; s=sys.stdin.read(); m=re.search(r'\\{\"id\":.*\"extra\":\{.*\}\}', s); j=json.loads(m.group(0)); print(j['launchAsset']['url'].split('/')[-1].split('&')[0])")"
-          LOCAL="$(python -c "import json; m=json.load(open('dist-ios/metadata.json')); print(m['fileMetadata']['ios']['bundle'].split('/')[-1])")"
+          LOCAL="$(python -c "import json; m=json.load(open('dist-${{ matrix.platform }}/metadata.json')); print(m['fileMetadata']['${{ matrix.platform }}']['bundle'].split('/')[-1])")"
           echo "Remote bundle: ${REMOTE}"
           echo "Local bundle:  ${LOCAL}"
           test "${REMOTE}" = "${LOCAL}"
@@ -202,27 +125,25 @@ jobs:
         with:
           node-version: '25.6.1'
           registry-url: 'https://registry.npmmirror.com'
+          cache: 'npm'
 
-      - name: Remove deprecated always-auth npm config
-        run: |
-          if [ -f ~/.npmrc ]; then
-            sed -i '/always-auth/d' ~/.npmrc
-          fi
+      - name: Install dependencies
+        run: npm ci
 
       - name: Cache Android NDK
         uses: actions/cache@v4
         id: cache-ndk
         with:
-          path: /opt/android/ndk/27.1.12297006
-          key: ndk-27.1.12297006-v1
+          path: /opt/android/ndk
+          key: ndk-v2
 
       - name: Install Android NDK
         if: steps.cache-ndk.outputs.cache-hit != 'true'
         run: |
           echo "Existing NDK versions:"
           ls /opt/android/ndk/ 2>/dev/null || echo "No NDK dir"
-          echo "Installing NDK 27.1.12297006..."
-          yes | sdkmanager --install "ndk;27.1.12297006"
+          echo "Installing required NDK versions..."
+          yes | sdkmanager --install "ndk;27.1.12297006" "ndk;27.0.12077973"
           echo "NDK after install:"
           ls /opt/android/ndk/
 
@@ -233,29 +154,19 @@ jobs:
             ~/.gradle/caches
             ~/.gradle/wrapper
             ~/.android/build-cache
-          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', '**/gradle.properties') }}
+          key: ${{ runner.os }}-gradle-${{ hashFiles('package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-gradle-
 
-      - name: Cache node_modules
-        uses: actions/cache@v4
-        id: cache-node-modules
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-modules-
-
-      - name: Install dependencies
-        if: steps.cache-node-modules.outputs.cache-hit != 'true'
-        run: npm ci
-
       - name: Generate Android native project
         run: npx expo prebuild --platform android
 
-      - name: Switch Gradle distribution to Tencent mirror
+      - name: Configure Gradle with China mirrors and signing
         run: |
-          PROPS="android/gradle/wrapper/gradle-wrapper.properties"
+          cd android
+          
+          # Switch Gradle distribution to Tencent mirror
+          PROPS="gradle/wrapper/gradle-wrapper.properties"
           if [ -f "$PROPS" ]; then
             sed -i 's|distributionUrl=https\\://services.gradle.org/distributions/|distributionUrl=https\\://mirrors.cloud.tencent.com/gradle/|' "$PROPS"
             echo "Updated gradle-wrapper.properties:"
@@ -264,14 +175,9 @@ jobs:
             echo "gradle-wrapper.properties not found"
             exit 1
           fi
-
-      - name: Decode Android signing keystore
-        run: |
-          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > android/app/withyou-release-key.keystore
-
-      - name: Configure Gradle with China Maven mirrors
-        run: |
-          cd android
+          
+          # Decode Android signing keystore
+          echo "${{ secrets.ANDROID_KEYSTORE_BASE64 }}" | base64 -d > app/withyou-release-key.keystore
           
           # Update settings.gradle with China Maven mirrors
           cat > settings.gradle << 'SETTINGS_EOF'
@@ -368,7 +274,7 @@ jobs:
           apply plugin: "com.facebook.react.rootproject"
           BUILD_EOF
           
-          # Update gradle.properties
+          # Update gradle.properties (without secrets for better cache hit rate)
           cat > gradle.properties << 'PROPS_EOF'
           org.gradle.daemon=false
           org.gradle.parallel=true
@@ -387,16 +293,18 @@ jobs:
           ndkVersion=27.1.12297006
           expo.useLegacyPackaging=false
           PROPS_EOF
-
-      - name: Configure Gradle signing properties
-        run: |
-          cd android
+          
+          # Append signing properties (secrets appended, not cached)
           cat >> gradle.properties << SIGNING_PROPS
           MYAPP_UPLOAD_STORE_FILE=withyou-release-key.keystore
           MYAPP_UPLOAD_STORE_PASSWORD=${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           MYAPP_UPLOAD_KEY_ALIAS=withyou-key
           MYAPP_UPLOAD_KEY_PASSWORD=${{ secrets.ANDROID_KEY_PASSWORD }}
           SIGNING_PROPS
+          
+          # Verify signing config in app/build.gradle
+          echo "=== app/build.gradle signing section ==="
+          grep -A 20 'signingConfigs' app/build.gradle || echo "signingConfigs not found"
 
       - name: Build Android release APK (arm64 only)
         run: |
@@ -405,7 +313,7 @@ jobs:
           ./gradlew :app:assembleRelease -PreactNativeArchitectures=arm64-v8a --max-workers=4 --parallel
 
       - name: Upload APK artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: withyou-android-release-apk
           path: android/app/build/outputs/apk/release/app-release.apk