feat(api): Android self-update endpoints proxied from Gitea releases (M5)

GET /api/v1/app/android/latest reads the latest Gitea release with the
server token (cached for 10 minutes); the download endpoint caches the
APK under /updates, verifies its SHA-256 and serves it with Range.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/openapi.yaml

@@ -18,6 +18,7 @@ tags:
   - name: playback
   - name: collection
   - name: wave
+  - name: app
 security:
   - bearerAuth: []
 paths:
@@ -1062,6 +1063,45 @@ paths:
                 $ref: "#/components/schemas/WaveBatch"
         default:
           $ref: "#/components/responses/Problem"
+  /api/v1/app/android/latest:
+    get:
+      operationId: getAndroidLatest
+      tags: [app]
+      summary: Последняя версия Android-приложения (из релизов Gitea через сервер)
+      description: |
+        Сервер сам опрашивает Gitea своим токеном и кэширует ответ на 10 минут, поэтому приложению
+        не нужен доступ к Gitea. Нет настроек Gitea или релиза с APK — `404 app.update_unavailable`.
+      responses:
+        "200":
+          description: Последний релиз
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AndroidRelease"
+        default:
+          $ref: "#/components/responses/Problem"
+  /api/v1/app/android/download/{version}:
+    get:
+      operationId: downloadAndroidApk
+      tags: [app]
+      summary: APK версии (кэшируется на сервере, поддерживает Range для докачки)
+      parameters:
+        - name: version
+          in: path
+          required: true
+          schema:
+            type: string
+            pattern: '^\d+\.\d+\.\d+(-rc\.\d+)?$'
+      responses:
+        "200":
+          description: APK
+          content:
+            application/vnd.android.package-archive:
+              schema:
+                type: string
+                format: binary
+        default:
+          $ref: "#/components/responses/Problem"
 components:
   parameters:
     SourceId:
@@ -2254,6 +2294,28 @@ components:
           description: Лайков на 100 треков
         sessions:
           type: integer
+    AndroidRelease:
+      type: object
+      required: [version, version_code, notes_md, size, sha256, download_url, min_supported]
+      properties:
+        version:
+          type: string
+          example: 0.6.1
+        version_code:
+          type: integer
+        notes_md:
+          type: string
+          description: Что нового (Markdown из релиза)
+        size:
+          type: integer
+          format: int64
+        sha256:
+          type: string
+        download_url:
+          type: string
+        min_supported:
+          type: integer
+          description: Версии ниже обязаны обновиться
     Session:
       type: object
       required: [id, device_name, client_type, created_at, last_used_at, current]