The Android app updates itself from our Gitea releases; feed cards fade in instead of bouncing

- API: GET /app/android/latest reads the latest Gitea release (ANDROID_RELEASES_URL, optional token for a
  private repo) with the APK's SHA-256 from SHA256SUMS; GET /app/android/apk/:name streams that APK.
- App (modules/updater): downloads in the background, checks the SHA-256, and installs through
  PackageInstaller: quietly once when leaving the app (Android 12+), otherwise from the feed banner or
  Settings > App version. F-Droid builds leave it out and drop the install permissions.
- CI: the release notes come from the fastlane changelog; the app shows the part above ---.
- Settings: Create-account and Link Spotify buttons for Last.fm and ListenBrainz.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/shared/src/client.ts

@@ -13,6 +13,7 @@ import type {
 import type { DeviceDTO } from './devices';
 import type { LyricsDTO } from './lyrics';
 import type { NotificationListDTO } from './notifications';
+import type { AppUpdateDTO } from './updates';
 import type {
   ChangeEmailInput,
   ChangePasswordInput,
@@ -160,6 +161,9 @@ export function createApiClient({ baseUrl, getToken, credentials }: ApiClientOpt
       request<ConnectionDTO>('/connections/jellyfin', { body: input }),
     disconnect: (provider: string) => request(`/connections/${q(provider)}`, { method: 'DELETE' }),
 
+    /** The newest Android release, or null when the server doesn't offer updates. */
+    androidUpdate: () => request<AppUpdateDTO | null>('/app/android/latest'),
+
     devices: () => request<DeviceDTO[]>('/me/devices'),
     /** The token is returned once; it can only report playback for this user. */
     registerDevice: (input: { platform: 'android' | 'ios'; name: string }) =>