The Android app updates itself from our Gitea releases; feed cards fade in instead of bouncing

- API: GET /app/android/latest reads the latest Gitea release (ANDROID_RELEASES_URL, optional token for a
  private repo) with the APK's SHA-256 from SHA256SUMS; GET /app/android/apk/:name streams that APK.
- App (modules/updater): downloads in the background, checks the SHA-256, and installs through
  PackageInstaller: quietly once when leaving the app (Android 12+), otherwise from the feed banner or
  Settings > App version. F-Droid builds leave it out and drop the install permissions.
- CI: the release notes come from the fastlane changelog; the app shows the part above ---.
- Settings: Create-account and Link Spotify buttons for Last.fm and ListenBrainz.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/production.env.example

@@ -43,3 +43,8 @@ VAPID_PUBLIC_KEY=
 VAPID_PRIVATE_KEY=
 # Lyrics: LRCLIB (or your own copy of it). Empty turns lyrics off.
 LRCLIB_URL=https://lrclib.net
+
+# App updates: the Android app checks the latest Gitea release through the API and updates itself.
+# Empty turns it off. The token needs read access to the repo, and only if the repo is private.
+ANDROID_RELEASES_URL=https://gitea.chrisedwards.tech/api/v1/repos/chris/musicshare/releases/latest
+ANDROID_RELEASES_TOKEN=