Wails ships no Gitea provider, so add updater/gitea (~250 lines): latest non-draft release newer than current wins, pre-releases skipped unless AllowPrerelease, exact AniTrack-linux-amd64 asset match, .sha512/.sig sidecars parsed into updater.Verification (sha512+ed25519ph, mirroring wails3 updater sign). Anything missing or malformed is an error, never an unsigned install. Includes semver compare, streaming download with progress, and unit tests (picking rules, fail-closed sidecars, server errors, progress) plus an opt-in live probe (ANITRACK_LIVE_TEST=1) proven against the real instance. Also: embed updater.pub (public half; private key lives in password manager + UPDATER_SIGNING_KEY CI secret, updater.key gitignored) and ignore CI-side updater-dist/ staging.
