Releases on Gitea, one-line installer and auto-update (1.1.0)

- .github/workflows/release.yml: a tag vX.Y.Z runs the tests, publishes
  daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256) and install-online.sh as a
  Gitea release, then builds the SD image with pi-gen and attaches it.
- install-online.sh: curl | sudo bash installer for the latest release.
- voxip-kiosk-updater: checks the latest release, verifies and unpacks a
  newer one under /opt/daynivo-kiosk-os and runs its update.sh. A daily
  timer checks around 03:00 and installs when auto_update is on.
- Web interface: Systeem -> Software-updates with the auto-update switch,
  check now and install now (helper verbs update-check / update-install).
- CI checks out with plain git, so it runs on Gitea's act_runner too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_web.py

@@ -305,3 +305,24 @@ def test_actions_menu_on_every_page(logged_in, path):
     html = logged_in.get(path).get_data(as_text=True)
     for action in ("/kiosk/reload", "/kiosk/restart", "/system/reboot", "/system/poweroff"):
         assert f'action="{action}"' in html
+
+
+def test_system_page_shows_update_state(logged_in, paths):
+    paths.update_state_file.write_text(json.dumps({"current": "1.1.0", "latest": "1.2.0", "available": True, "checked_at": 1_800_000_000}))
+    body = logged_in.get("/system").get_data(as_text=True)
+    assert "Software-updates" in body and "Bijwerken naar 1.2.0" in body
+
+
+def test_auto_update_setting(logged_in, paths):
+    logged_in.post("/system/updates", data={"csrf_token": token(logged_in), "auto_update": "1"})
+    assert load_config(paths.config_file)["auto_update"] is True
+    logged_in.post("/system/updates", data={"csrf_token": token(logged_in)})
+    assert load_config(paths.config_file)["auto_update"] is False
+
+
+def test_update_check_and_install_go_through_the_helper(logged_in, fake_helper):
+    fake_helper.responses["update-check"] = {"update": {"current": "1.1.0", "latest": "1.2.0", "available": True}}
+    resp = logged_in.post("/system/update/check", data={"csrf_token": token(logged_in)}, follow_redirects=True)
+    assert "Versie 1.2.0 is beschikbaar" in resp.get_data(as_text=True)
+    logged_in.post("/system/update/install", data={"csrf_token": token(logged_in)})
+    assert [c[0] for c in fake_helper.calls] == ["update-check", "update-install"]