feat(api): Android self-update endpoints proxied from Gitea releases (M5)

GET /api/v1/app/android/latest reads the latest Gitea release with the
server token (cached for 10 minutes); the download endpoint caches the
APK under /updates, verifies its SHA-256 and serves it with Range.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/api/internal/server/router.go

@@ -9,6 +9,7 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 
 	"pipu/api/internal/api/gen"
+	"pipu/api/internal/appupdate"
 	"pipu/api/internal/auth"
 	"pipu/api/internal/library"
 	"pipu/api/internal/platform/httpx"
@@ -30,6 +31,7 @@ type Deps struct {
 	Playback *playback.Handler
 	// Wave — «Моя волна».
 	Wave *wave.Handler
+	App  *appupdate.Handler
 	// AuthService проверяет access-токены в middleware. nil — только для тестов служебных эндпоинтов.
 	AuthService *auth.Service
 }
@@ -44,6 +46,7 @@ type (
 	searchHandler   = search.Handler
 	playbackHandler = playback.Handler
 	waveHandler     = wave.Handler
+	appHandler      = appupdate.Handler
 )
 
 type handlers struct {
@@ -53,6 +56,7 @@ type handlers struct {
 	*searchHandler
 	*playbackHandler
 	*waveHandler
+	*appHandler
 }
 
 var _ gen.StrictServerInterface = handlers{}
@@ -72,7 +76,7 @@ func NewRouter(d Deps) http.Handler {
 	r.NotFound(httpx.NotFound)
 	r.MethodNotAllowed(httpx.MethodNotAllowed)
 
-	strict := gen.NewStrictHandlerWithOptions(handlers{systemHandler: d.System, authHandler: d.Auth, libraryHandler: d.Library, searchHandler: d.Search, playbackHandler: d.Playback, waveHandler: d.Wave},
+	strict := gen.NewStrictHandlerWithOptions(handlers{systemHandler: d.System, authHandler: d.Auth, libraryHandler: d.Library, searchHandler: d.Search, playbackHandler: d.Playback, waveHandler: d.Wave, appHandler: d.App},
 		[]gen.StrictMiddlewareFunc{httpx.StrictRequest}, gen.StrictHTTPServerOptions{
 			RequestErrorHandlerFunc:  httpx.RequestError,
 			ResponseErrorHandlerFunc: httpx.ResponseError(log),