Releases on Gitea, one-line installer and auto-update (1.1.0)

- .github/workflows/release.yml: a tag vX.Y.Z runs the tests, publishes
  daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256) and install-online.sh as a
  Gitea release, then builds the SD image with pi-gen and attaches it.
- install-online.sh: curl | sudo bash installer for the latest release.
- voxip-kiosk-updater: checks the latest release, verifies and unpacks a
  newer one under /opt/daynivo-kiosk-os and runs its update.sh. A daily
  timer checks around 03:00 and installs when auto_update is on.
- Web interface: Systeem -> Software-updates with the auto-update switch,
  check now and install now (helper verbs update-check / update-install).
- CI checks out with plain git, so it runs on Gitea's act_runner too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,77 @@
+# Gitea Actions: a tag vX.Y.Z (matching VERSION) becomes a release with
+#   daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256)   installed by install-online.sh and the updater
+#   install-online.sh                            the one-line installer
+#   <date>-daynivo-kiosk-os-X.Y.Z.img.xz (+ .sha256), built afterwards (30–90+ minutes)
+#
+# Runner requirements: act_runner with the "ubuntu-latest" label, and for the
+# image job `container.privileged: true` in its config (pi-gen needs loop
+# devices and binfmt_misc). A secret RELEASE_TOKEN (repository write access)
+# is used when set, otherwise the job's own token.
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+env:
+  GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
+  GITEA_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.GITEA_TOKEN }}
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    container: debian:bookworm
+    steps:
+      - name: Tools
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            ca-certificates curl git python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
+      - name: Checkout
+        # Plain git: JavaScript actions need Node, which debian:bookworm doesn't have.
+        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
+      - name: Tag matches VERSION
+        working-directory: src
+        run: test "v$(tr -d '[:space:]' < VERSION)" = "${{ github.ref_name }}"
+      - name: Tests
+        working-directory: src
+        run: |
+          python3 -m pytest -q -p no:cacheprovider
+          shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh
+      - name: Package
+        working-directory: src
+        run: |
+          V="$(tr -d '[:space:]' < VERSION)"
+          mkdir -p ../dist
+          git archive --prefix="daynivo-kiosk-os-$V/" -o "../dist/daynivo-kiosk-os-$V.tar.gz" HEAD
+          (cd ../dist && sha256sum "daynivo-kiosk-os-$V.tar.gz" > "daynivo-kiosk-os-$V.tar.gz.sha256")
+          cp install-online.sh ../dist/
+      - name: Publish
+        run: src/tools/release-upload.sh "${{ github.ref_name }}" dist/*
+
+  image:
+    needs: package
+    runs-on: ubuntu-latest
+    container:
+      image: debian:bookworm
+      options: --privileged
+    timeout-minutes: 360
+    steps:
+      - name: Tools (pi-gen)
+        run: |
+          apt-get update
+          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+            ca-certificates curl git python3 openssl coreutils quilt parted qemu-user-static binfmt-support \
+            debootstrap zerofree zip dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file bc gpg \
+            pigz xxd arch-test bmap-tools kmod fdisk udev
+      - name: Enable ARM emulation
+        run: |
+          mountpoint -q /proc/sys/fs/binfmt_misc || mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc
+          update-binfmts --enable qemu-arm
+      - name: Checkout
+        run: git clone --depth 1 --branch "${{ github.ref_name }}" "${{ github.server_url }}/${{ github.repository }}.git" src
+      - name: Build image
+        working-directory: src
+        run: ./image/build.sh --native
+      - name: Publish
+        run: src/tools/release-upload.sh "${{ github.ref_name }}" src/image/deploy/*.img.xz src/image/deploy/*.img.xz.sha256