An updater: what is published on Gitea, and installing it from Settings

A new selfupdate package asks one URL what the newest build is — a Gitea/Forgejo repo
API base, or any directory holding VERSION, SHA256SUMS and hamlab-linux-<arch>, which is
what make release already writes and what install.sh already downloads. The binary is
checked against SHA256SUMS before it goes near the running one, and a token is sent when
the source is behind a login, so a private Gitea serves its own fleet without opening the
instance to everyone. Version ordering is install.sh's vnum rule, so the daemon and the
installer never disagree about which build is newer.

Settings gains an Updates card: installed, published, when it last looked, the source,
release notes, Check for updates, and Install. The rail badges Settings when a newer
build is out. Nothing installs unasked — it restarts the daemon and drops terminals.

scripts/gitea-release.sh (make gitea-release) publishes dist/ as a Gitea release.
Deliberate, and not part of deploy: deploy pushes to the machines this hub owns,
publishing offers the build to every install anywhere.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/config/config.go

@@ -48,6 +48,19 @@ type User struct {
 	LastSeen time.Time `json:"last_seen,omitempty"`
 }
 
+// UpdateSource is where this machine looks for a newer Ham Lab, and how often. The field
+// is Updates, not Update, because Config already has an Update method.
+type UpdateSource struct {
+	// URL is a Gitea/Forgejo repo API base or a static directory; empty means the built-in
+	// default, and "off" means never look.
+	URL string `json:"url,omitempty"`
+	// Token is sent when the source is behind a login, so a private Gitea can serve its
+	// own fleet without the instance being opened to everyone.
+	Token string `json:"token,omitempty"`
+	// Check is "daily" (the default) or "never".
+	Check string `json:"check,omitempty"`
+}
+
 type Config struct {
 	Listen string `json:"listen"`
 	// PasswordHash is the single login of installs before users existed. On load it becomes
@@ -60,6 +73,8 @@ type Config struct {
 	// DemoURL, when set, is linked from the Widgets tab: a page outside Ham Lab that
 	// shows the sensor API being used (examples/external-demo).
 	DemoURL string `json:"demo_url,omitempty"`
+	// Updates: where a newer build comes from. See UpdateSource.
+	Updates UpdateSource `json:"update,omitempty"`
 
 	path string
 	mu   sync.Mutex