implement ota updates

README.md

@@ -191,6 +191,7 @@ and you can fill everything in from **Settings**.
 | `SCHEDULER_ENABLED`, `TELEGRAM_BOT_ENABLED` | switch the background jobs / bot off |
 | `AUTH_USERNAME`, `AUTH_PASSWORD` | closes the **browser UI** behind a login; see [Going public](#going-public) |
 | `TELEGRAM_OWNER_ID`, `TELEGRAM_BOT_USERNAME` | lets that same browser login happen via the Telegram Login Widget |
+| `GITEA_TOKEN`, `GITEA_REPO`, `GITEA_URL`, `GITEA_UPDATE_BRANCH` | lets the backend read the private repo's Actions artifacts for Android OTA updates; empty token disables the update endpoints |
 
 ---
 
@@ -213,7 +214,7 @@ and you can fill everything in from **Settings**.
 
 * `backend/` — FastAPI app. `app/services/` holds the thinking (timer, tasks,
   stats, report, blocker policy, scheduler, bot); `app/sources/` holds one module
-  per integration; `app/api/` is a thin HTTP layer. 73 tests under `backend/tests`.
+  per integration; `app/api/` is a thin HTTP layer. 78 tests under `backend/tests`.
 * `frontend/` — React + TypeScript + MUI, built by Vite into the backend image and
   served from the same origin (so there is no CORS to configure).
 * **The look** — warm paper, ink type, hairline rules instead of boxes and
@@ -270,14 +271,17 @@ Gitea Actions, in `.gitea/workflows/`:
 
 | Workflow | When | What |
 | --- | --- | --- |
-| `test.yml` | push to master, every PR | backend (73), desktop (47), `:core` (193), and the web app's typecheck + build — four parallel jobs, none of which may need a running backend |
+| `test.yml` | push to master, every PR | backend (78), desktop (47), `:core` (193), and the web app's typecheck + build — four parallel jobs, none of which may need a running backend |
 | `lint.yml` | push to master, every PR | `ruff check` over `backend/` and `desktop/`, with the rule set named in `backend/pyproject.toml` |
 | `docker.yml` | push to master, `v*` tags | builds the image, starts it against SQLite and waits for `/api/health`, then pushes `git.timka.su/timka123/kadence:latest` and `:<short-sha>` |
-| `android-release.yml` | push to master, `v*` tags | `:app`'s suite (81, on the JVM), then the release APK — signed from secrets, with `apksigner verify` printing the certificate it actually used |
+| `android-release.yml` | push to master, `v*` tags | `:app`'s suite (89, on the JVM), then the release APK and the small OTA metadata artifact — signed from secrets, with `apksigner verify` printing the certificate it actually used |
 
 **Nothing runs until a docker-mode runner is registered** —
 [`docs/gitea-runner.md`](docs/gitea-runner.md) is the guide, and
 `docker-compose.ci.yml` + `deploy/act-runner.yaml` are the two files it installs.
+Once it is online, [`docs/production-builds.md`](docs/production-builds.md) covers
+the release path: tagging, secrets, verifying the image and APK, deploying, and
+rolling back.
 Short version, on the runner host:
 
 ```bash