Replay fuori da Puma, fix ops cron e firma release Android.

Dopo auth Rails redirect a URL presigned su /media/ (edge → Garage); aumenta
RAILS_MAX_THREADS, corregge ingest log ops via stdin e keystore Play Console.

Co-authored-by: Cursor <cursoragent@cursor.com>

infra/.env.production.example

@@ -66,6 +66,12 @@ REPLAY_STORAGE_REGION=garage
 REPLAY_STORAGE_ACCESS_KEY_ID=
 REPLAY_STORAGE_SECRET_ACCESS_KEY=
 REPLAY_STORAGE_FORCE_PATH_STYLE=true
+# Streaming replay: Rails fa auth, edge serve /media/ → Garage (non passa da Puma)
+REPLAY_MEDIA_PUBLIC_BASE_URL=https://www.matchlivetv.it/media
+REPLAY_MEDIA_REDIRECT=true
+
+# Puma: 5 thread (no secondo worker senza più RAM)
+RAILS_MAX_THREADS=5
 
 # Ops monitoring — notifiche push (ntfy self-hosted) e health check
 # 1) Avvia servizio: docker compose up -d ntfy