feat(updater): custom Gitea releases provider with fail-closed verification

Wails ships no Gitea provider, so add updater/gitea (~250 lines): latest non-draft release newer than current wins, pre-releases skipped unless AllowPrerelease, exact AniTrack-linux-amd64 asset match, .sha512/.sig sidecars parsed into updater.Verification (sha512+ed25519ph, mirroring wails3 updater sign). Anything missing or malformed is an error, never an unsigned install. Includes semver compare, streaming download with progress, and unit tests (picking rules, fail-closed sidecars, server errors, progress) plus an opt-in live probe (ANITRACK_LIVE_TEST=1) proven against the real instance. Also: embed updater.pub (public half; private key lives in password manager + UPDATER_SIGNING_KEY CI secret, updater.key gitignored) and ignore CI-side updater-dist/ staging.

.gitignore

@@ -33,6 +33,9 @@ frontend/package.json.md5
 .idea
 .env
 environment.go
+# Updater signing private key. The public half (updater.pub) is committed and
+# embedded; the private key lives in the password manager + CI secrets only.
+updater.key
 
 # REST (http files)
 http-client.private.env.json
@@ -41,3 +44,5 @@ http-client.private.env.json
 *.tar
 *.tar.gz
 /AniTrack
+# Updater CI staging (bare binary + sidecars, runner-ephemeral)
+updater-dist/