The Android app updates itself from our Gitea releases; feed cards fade in instead of bouncing

- API: GET /app/android/latest reads the latest Gitea release (ANDROID_RELEASES_URL, optional token for a
  private repo) with the APK's SHA-256 from SHA256SUMS; GET /app/android/apk/:name streams that APK.
- App (modules/updater): downloads in the background, checks the SHA-256, and installs through
  PackageInstaller: quietly once when leaving the app (Android 12+), otherwise from the feed banner or
  Settings > App version. F-Droid builds leave it out and drop the install permissions.
- CI: the release notes come from the fastlane changelog; the app shows the part above ---.
- Settings: Create-account and Link Spotify buttons for Last.fm and ListenBrainz.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/mobile/modules/updater/src/UpdaterModule.ts

@@ -0,0 +1,30 @@
+import { NativeModule, requireOptionalNativeModule } from 'expo';
+
+/**
+ * What the system did with an install: `installed` (rarely seen: updating ourselves ends this process),
+ * `needs_user` (a quiet install wasn't allowed; it has to be started from the app), `waiting` (the system's
+ * confirmation screen is showing), `cancelled`, or `failed`.
+ */
+export type InstallStatus = 'installed' | 'needs_user' | 'waiting' | 'cancelled' | 'failed';
+
+type Events = {
+  onProgress: (event: { received: number; total: number }) => void;
+  onInstallStatus: (event: { status: InstallStatus; message: string | null }) => void;
+};
+
+declare class MusicshareUpdaterModule extends NativeModule<Events> {
+  /** Delete downloaded updates (once installed, or no longer wanted). */
+  clearDownloads(): void;
+  /** This build's versionName, e.g. "1.1.0". */
+  currentVersion(): string;
+  /** Download to the app's cache and check the SHA-256; resolves with the file's path. Reuses an earlier complete download. */
+  download(url: string, sha256: string, fileName: string): Promise<string>;
+  /**
+   * Hand the APK to the system installer. `interactive` shows the system's confirmation when it's needed;
+   * otherwise only a quiet install is tried. The outcome arrives as onInstallStatus.
+   */
+  install(path: string, interactive: boolean): Promise<void>;
+}
+
+/** Android only; null elsewhere and in Expo Go. */
+export default requireOptionalNativeModule<MusicshareUpdaterModule>('MusicshareUpdater');