The Android app updates itself from our Gitea releases; feed cards fade in instead of bouncing

- API: GET /app/android/latest reads the latest Gitea release (ANDROID_RELEASES_URL, optional token for a
  private repo) with the APK's SHA-256 from SHA256SUMS; GET /app/android/apk/:name streams that APK.
- App (modules/updater): downloads in the background, checks the SHA-256, and installs through
  PackageInstaller: quietly once when leaving the app (Android 12+), otherwise from the feed banner or
  Settings > App version. F-Droid builds leave it out and drop the install permissions.
- CI: the release notes come from the fastlane changelog; the app shows the part above ---.
- Settings: Create-account and Link Spotify buttons for Last.fm and ListenBrainz.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/mobile/plugins/withoutSelfUpdate.js

@@ -0,0 +1,17 @@
+// F-Droid builds (MUSICSHARE_FOSS=1) get their updates from F-Droid, so they mustn't be able to
+// install packages themselves: remove the permissions the updater module (modules/updater) adds.
+const { AndroidConfig, withAndroidManifest } = require('expo/config-plugins');
+
+const PERMISSIONS = ['android.permission.REQUEST_INSTALL_PACKAGES', 'android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION'];
+
+module.exports = function withoutSelfUpdate(config) {
+  return withAndroidManifest(config, (cfg) => {
+    const manifest = AndroidConfig.Manifest.ensureToolsAvailable(cfg.modResults).manifest;
+    const existing = manifest['uses-permission'] ?? [];
+    manifest['uses-permission'] = [
+      ...existing.filter((p) => !PERMISSIONS.includes(p.$['android:name'])),
+      ...PERMISSIONS.map((name) => ({ $: { 'android:name': name, 'tools:node': 'remove' } })),
+    ];
+    return cfg;
+  });
+};