docs: record self-updates design and correct branch map

Add the Self-updates section (provider, signing, gates, beta channel, binary-only scope, key custody) and fix the two stale branch-map lines that still described main as the v2 line. History above untouched.

docs/V3_MIGRATION.md

@@ -34,16 +34,33 @@ On Linux, `v2` tokens lived in an `AniTrack` Secret Service collection as labele
 
 In practice: running both versions side-by-side works fine — each reads its own collection, neither overwrites the other. If you fully move to `v3`, just log into AniList / MAL / Simkl once there; the `v2` entries become stale but harmless (11 small items). See the notice in `README.md: Migrating from v2` — no automatic deletion, on purpose.
 
+## Self-updates (desktop Linux, 1.99.x)
+
+Releases self-update in place via the Wails v3 updater (`app.Updater`): a
+custom Gitea provider (`updater/gitea` — Wails ships none for Gitea) checks
+the Gitea releases API, and CI publishes a signed bare-binary asset
+(`AniTrack-linux-amd64` + `.sha512`/`.sig` sidecars from
+`wails3 updater sign`) next to the user tarball. Verification is fail-closed;
+a release missing any of the three files is skipped. Gated to desktop
+production builds (`application.System.IsDesktop()` + `-tags production`) —
+mobile stays on Obtainium, dev builds never check. The startup check is
+headless; the builtin window opens only when an update is found.
+`ANITRACK_UPDATER_CHANNEL=beta` includes `-rc` pre-releases (testing only).
+Only the binary self-swaps; icons/`.desktop` still come from the tarball's
+`install_linux.sh`. Signing: public half `updater.pub` is embedded; the
+private key lives in the password manager + the `UPDATER_SIGNING_KEY` CI
+secret, never in the repo (see `.gitignore`).
+
 ## Future plans on v3
 
 **Not yet done — staged after the desktop migration, in order** (each with its home branch, so nothing lands in the wrong place):
 
-1. **Stabilize desktop `v3` (on `wailsv3` — this branch's whole purpose):** real-world dogfooding (logins, watchlist sync, error modals), then merge to `main` when Wails `v3` hits stable.
+1. **Stabilize desktop `v3`:** real-world dogfooding of `main` (logins, watchlist sync, error modals). Merged to `main` as the `1.99.x` beta series while Wails `v3` is still beta upstream.
 2. **Frontend toolchain refresh (on `wailsv3`, before the merge):** Svelte 4 → 5, Vite 4 → 8, `vite-plugin-svelte 2 → 7`, Tailwind 3 → 4 — majors deferred intentionally; they pair naturally with `v3`’s Svelte 5 templates and touch the same desktop files, so no separate branch.
 3. **Android (short-lived feature branch off `wailsv3`, e.g. `wailsv3-android`, merged back):** personal sideload, no Play/official F-Droid. Per-file `//go:build android` shims — `zalando` → `Android.Secure*` (`EncryptedSharedPreferences`), and `localhost:6734` OAuth callbacks → deep-link `anitrack://callback` + intent filter; start with one provider (AniList) to prove the pattern. Responsive / safe-area polish. Distribution via `adb install` + GitHub Releases + Obtainium. Kept off `wailsv3` proper so the mobile scaffolding (`build/android/`, manifests, gradle files) doesn't pollute the desktop-to-`main` merge.
 4. **CI follow-ups (wherever the work they support lives):** none required for desktop; the current 4 caches + the fixed runner cache backend already bring releases from ~12 min to ~3 min. Builder image only if the 2 min apt floor becomes annoying.
 
 ## Branch map
 
-- `main` — still `v2`, stable, ships `1.6.8` releases.
-- `wailsv3` — `v3` desktop, unpushed until dogfooding passes, ahead of `main` by the commits above plus `2bf8d38` (`frontend/package-lock.json`) and `efe45f3`/`a19080e`/`336a1f3` from the CI/cache work. Merge `main` forward before each `v3` push.
+- `main` — v3 desktop, ships `1.99.x` beta-series releases.
+- `wailsv3` — retained as an alias tracking `main` for now.