Publish updates to the Gitea package registry, and build the installer on macOS

The dev machine is now a laptop, so the release path had to stop assuming Windows
and a reachable network share.

- tools/build-win.cjs: build the Windows x64 installer from macOS or Windows.
  electron-builder fetches its own mac wine build, so the only real trap is
  architecture: a plain `electron-builder --win` on Apple Silicon silently
  produces an arm64 installer the stage PC cannot run. This pins --x64 and
  strips the CSC_* signing vars (an EMPTY WIN_CSC_LINK aborts the build).
- tools/publish-update.cjs: an http(s) destination now uploads to a Gitea
  generic package registry. Not a Gitea release: this server caps release
  attachments at 100 MB and disallows .exe, while the package registry takes the
  750 MB installer and serves it anonymously — which the updater requires, since
  it sends no credentials. Installer first, manifest last, so a TV checking
  mid-publish never sees a manifest naming a file that is not there yet.
- tools/release.cjs: bump, build and publish in one command.
- server.js: honour "check for updates automatically when the app starts". The
  setting was stored but never acted on. It checks only — installing restarts
  the app, which must stay a deliberate tap.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/build-win.cjs

@@ -0,0 +1,35 @@
+/*
+ * build-win.cjs — build the Windows x64 installer. Works on Windows AND on macOS: electron-builder
+ * fetches its own mac build of wine for the few Windows-only steps, so the laptop can produce the
+ * exact installer the stage PC installs.
+ *
+ *   npm run build:win
+ *
+ * Two things this wrapper exists to guarantee:
+ *
+ *  - --x64. electron-builder otherwise targets the HOST architecture, so on an Apple Silicon Mac a
+ *    plain `electron-builder --win` quietly produces an arm64 build that the stage PC cannot run.
+ *  - a clean signing environment. There is no code-signing certificate. electron-builder aborts on
+ *    an EMPTY WIN_CSC_LINK ("Env WIN_CSC_LINK is not correct"), so those variables are removed
+ *    rather than blanked, and identity auto-discovery is turned off.
+ */
+const { spawnSync } = require('child_process');
+const path = require('path');
+
+const env = { ...process.env, CSC_IDENTITY_AUTO_DISCOVERY: 'false' };
+for (const key of ['CSC_LINK', 'WIN_CSC_LINK', 'CSC_KEY_PASSWORD', 'WIN_CSC_KEY_PASSWORD', 'CSC_KEYCHAIN']) {
+  delete env[key];
+}
+
+const extra = process.argv.slice(2);
+const args = ['electron-builder', '--win', '--x64', ...extra];
+
+console.log(`Building the Windows x64 installer on ${process.platform}…`);
+const r = spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', args, {
+  cwd: path.join(__dirname, '..'),
+  env,
+  stdio: 'inherit',
+  shell: process.platform === 'win32'
+});
+if (r.error) { console.error('Build failed to start:', r.error.message); process.exit(1); }
+process.exit(r.status === null ? 1 : r.status);