feat(api): Android self-update endpoints proxied from Gitea releases (M5)

GET /api/v1/app/android/latest reads the latest Gitea release with the
server token (cached for 10 minutes); the download endpoint caches the
APK under /updates, verifies its SHA-256 and serves it with Range.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/cmd/api/main.go

@@ -18,6 +18,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/redis/go-redis/v9"
 
+	"pipu/api/internal/appupdate"
 	"pipu/api/internal/auth"
 	"pipu/api/internal/buildinfo"
 	"pipu/api/internal/library"
@@ -144,6 +145,8 @@ func run() error {
 		Playback:    pb,
 		Wave: wave.NewHandler(pool, &wave.Recommender{URL: cfg.RecommenderURL, Token: cfg.InternalToken,
 			Client: &http.Client{}}, libStore, func() library.DTO { return dto }, log),
+		App: appupdate.NewHandler(appupdate.Config{GiteaURL: cfg.GiteaURL, Repo: cfg.GiteaRepo, Token: cfg.GiteaToken,
+			Dir: cfg.UpdatesDir, MinSupported: cfg.MinAndroidVersionCode}, log),
 	}))
 	log.Info("starting", "version", buildinfo.Version)
 	return httpx.Serve(ctx, log, srv, cfg.ShutdownTimeout)