Releases on Gitea, one-line installer and auto-update (1.1.0)

- .github/workflows/release.yml: a tag vX.Y.Z runs the tests, publishes
  daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256) and install-online.sh as a
  Gitea release, then builds the SD image with pi-gen and attaches it.
- install-online.sh: curl | sudo bash installer for the latest release.
- voxip-kiosk-updater: checks the latest release, verifies and unpacks a
  newer one under /opt/daynivo-kiosk-os and runs its update.sh. A daily
  timer checks around 03:00 and installs when auto_update is on.
- Web interface: Systeem -> Software-updates with the auto-update switch,
  check now and install now (helper verbs update-check / update-install).
- CI checks out with plain git, so it runs on Gitea's act_runner too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_helper.py

@@ -199,3 +199,20 @@ def test_boot_import_rejects_non_key_lines(helper, boot):
     (boot / "voxip-authorized_keys").write_text("dit is geen sleutel\n")
     helper.boot_import()
     assert (boot / "voxip-authorized_keys.rejected").exists()
+
+
+def test_update_verbs_are_public_and_install_runs_in_its_own_unit(helper):
+    assert {"update-check", "update-install"} <= h.PUBLIC_VERBS
+    result = helper.dispatch("update-install", [])
+    assert "gestart" in result["message"]
+    command = helper.run.ran("systemd-run")[-1]
+    assert f"--unit={h.UPDATE_UNIT}" in command and command[-2:] == [h.UPDATER_PATH, "--install"]
+
+
+def test_update_install_reports_a_running_update(helper):
+    def busy(args, timeout=30, check=True, input=None):
+        return subprocess.CompletedProcess(args, 1, stdout="", stderr="Unit voxip-kiosk-update-now.service already exists.")
+
+    helper.run = busy
+    with pytest.raises(h.HelperError, match="al een update"):
+        helper.dispatch("update-install", [])