feat(ci): automate Linux release builds and Gitea releases

Local flow is now ./release 1.6.7 (or make release VERSION=1.6.7):
bump wails.json productVersion, commit the bump, generate git-cliff
notes into an annotated plain-version tag, and push commit plus tag.
The tag push fires the new Gitea Actions workflow.

- cliff.toml: git-cliff groups matching Bookhoard, tag_pattern for
  plain versions so --latest scopes correctly.
- Makefile release target: strict plain-semver validation, dirty-tree
  and existing-tag guards, python3 wails.json bump committed as
  chore(release), throwaway-tag notes generation, push of main + tag.
- release: wrapper normalizing v/AniTrack- prefixes to plain versions.
- .gitea/workflows/release.yml: version guard (wails.json vs tag,
  base-match for -suffix pre-releases), Go 1.25 / Node 20 / Wails
  v2.15.0 + webkit2_41 system deps, environment.go from Actions
  secrets, make build, AniTrack-<version>.tar.gz packaged from
  build/ (bin, icon, desktop, install script, README), idempotent
  Release create/update named AniTrack-<version> with archive
  attached via REGISTRY_TOKEN PAT.

Makefile

@@ -1,6 +1,6 @@
 TAGS := webkit2_41
 
-.PHONY: dev build clean
+.PHONY: dev build clean release
 
 dev:
 	wails dev -tags $(TAGS)
@@ -10,3 +10,42 @@ build:
 
 clean:
 	rm -rf build/bin/*
+
+# Create a version commit (wails.json bump, committed and pushed) plus an
+# annotated version tag carrying auto-generated release notes (git-cliff),
+# and push both. The tag push triggers .gitea/workflows/release.yml, which
+# verifies wails.json matches the tag, builds via `make build`, packages
+# AniTrack-<VERSION>.tar.gz from build/, and publishes a Gitea Release
+# named AniTrack-<VERSION> with the archive attached. Notes come entirely
+# from Conventional Commits — no hand-written message required.
+#
+# git-cliff's --latest needs the tag to exist to scope the notes, so we
+# create a throwaway lightweight tag, generate the notes, replace it with
+# an annotated tag, then push. --cleanup=verbatim keeps the markdown "###"
+# group headers (git's default cleanup would strip lines starting with "#").
+#
+# Tags are plain versions (1.6.7) to match wails.json productVersion and the
+# existing tag history. Pre-releases are created by tagging manually with a
+# suffix (e.g. 1.6.7-rc1 on top of the bumped commit) — the workflow marks
+# those as prerelease. Use ./release as a shortcut.
+#
+# Requires git-cliff: https://git-cliff.org/install
+# Usage: make release VERSION=1.6.7
+release:
+	@test -n "$(VERSION)" || { echo "Usage: make release VERSION=1.6.7"; exit 1; }
+	@echo "$(VERSION)" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$$' || { echo "VERSION must be plain semver like 1.6.7 (no v prefix, no AniTrack- prefix, no suffix)"; exit 1; }
+	@command -v git-cliff >/dev/null 2>&1 || { echo "git-cliff not found — install: https://git-cliff.org/install"; exit 1; }
+	@command -v python3 >/dev/null 2>&1 || { echo "python3 not found — required to bump wails.json"; exit 1; }
+	@git diff --quiet && git diff --cached --quiet || { echo "Working tree dirty — commit or stash first"; exit 1; }
+	@if git rev-parse "$(VERSION)" >/dev/null 2>&1; then echo "Tag $(VERSION) already exists locally — delete it first: git tag -d $(VERSION)"; exit 1; fi
+	@echo "Bumping wails.json to $(VERSION)..."
+	@python3 -c "import json; p='wails.json'; d=json.load(open(p)); d['info']['productVersion']='$(VERSION)'; json.dump(d, open(p,'w'), indent=2); open(p,'a').write('\n')"
+	@git add wails.json
+	@git commit -m "chore(release): bump version to $(VERSION)"
+	@echo "Generating release notes for $(VERSION)..."
+	@git tag "$(VERSION)" HEAD && \
+		(git cliff --latest --config cliff.toml > .release-notes.tmp && git tag -d "$(VERSION)" >/dev/null) || \
+		{ git tag -d "$(VERSION)" >/dev/null 2>&1; rm -f .release-notes.tmp; echo "git-cliff failed"; exit 1; }
+	@git tag -a --cleanup=verbatim -F .release-notes.tmp "$(VERSION)" HEAD && rm -f .release-notes.tmp
+	@git push origin main "$(VERSION)"
+	@echo "Pushed $(VERSION) — Gitea Actions will build, package, and publish AniTrack-$(VERSION).tar.gz."