Merge the maps screen into the places map, and fix station search

[ialakey]

Two bugs found in the 2.0.0+13 build, and the release tooling that produced it.

One map instead of two screens

"Карты" and "Места" answered the same question. The first was a dropdown of
four Google My Maps links in a WebView; the second is the OpenStreetMap
catalogue. Everything the old screen pointed at is now on the new map:

Old entry	Where it went
Russian venues (My Maps, 314 points)	Already there — it is the same stats.srb.guide catalogue, and the bundled copy is fresher (362 points)
Non-smoking venues (150 points)	Bundled as pins: 145 venues, 94 with smoking banned outright and 51 where only smokeless devices are allowed
Exchange offices	Never a dataset, only a live Google Maps search for "Мењачница" — now a button in the map's toolbar
Black list of apartments	Dropped: its My Map returns Google 403, so the link was already dead in the shipped app

tool/sync_smoking.dart reads the KML export of the Lokali bez dima map into
assets/data/smoking.json, and the weekly sync workflow keeps it current as a
fourth dataset. Filter chips cover the smoking policy next to the business
categories; a venue on both lists is matched by name and proximity so it gets
one pin rather than two. webview_flutter goes with the deleted screen —
nothing else used it.

Train stations are searchable in Russian

Typing "Белград" returned an alphabetical dump of the whole network, which read
as the search being broken. The lookup at w3.srbvoz.rs only understands Latin:
its own front end strips everything else out of the term, so a Cyrillic query
arrives empty — and an empty term is answered with all 396 stations.

The list is now fetched once (15 KB), cached for a week and matched on device:
Cyrillic is transliterated, diacritics are folded, each word gets one character
of slack for the spelling differences (Белград/Beograd, Крагуевац/Kragujevac),
and matching runs inside the name, so centar finds BEOGRAD CENTAR — which the
server itself could not do. A network failure is now reported as a failure
rather than as "nothing found", and there is no longer a request per keystroke.

Release tooling

tool/build_release.ps1 mirrors release.yml, so a local build and a tagged CI
build produce the same artifact under the same checks. It refuses to spend a
build on a missing key.properties, a key that is not SHA256withRSA, or a
versionCode Play has already seen, then verifies the APK signature scheme,
the bundle signature and the merged targetSdk before copying both artifacts
into dist/ with their sums. docs/RELEASE.md walks through a release, and
docs/CHANGELOG.md records what changed since versionCode 12.

Verification

• flutter analyze clean; 81 tests pass, including 21 new ones for catalogue
  merging and station matching, and a live check that Белград resolves to
  BEOGRAD CENTAR against the real timetable
• Signed release built at 2.0.0+14 and verified: APK Signature Scheme v2,
  SHA-256 certificate, not the debug key, targetSdk 36
• Checked on an Android 16 emulator: 498 pins on the merged map, the
  non-smoking filter, and centar matching three stations