Releases on Gitea, one-line installer and auto-update (1.1.0)

- .github/workflows/release.yml: a tag vX.Y.Z runs the tests, publishes
  daynivo-kiosk-os-X.Y.Z.tar.gz (+ .sha256) and install-online.sh as a
  Gitea release, then builds the SD image with pi-gen and attaches it.
- install-online.sh: curl | sudo bash installer for the latest release.
- voxip-kiosk-updater: checks the latest release, verifies and unpacks a
  newer one under /opt/daynivo-kiosk-os and runs its update.sh. A daily
  timer checks around 03:00 and installs when auto_update is on.
- Web interface: Systeem -> Software-updates with the auto-update switch,
  check now and install now (helper verbs update-check / update-install).
- CI checks out with plain git, so it runs on Gitea's act_runner too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/release-upload.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+#
+# Attach files to the Gitea release of a tag, creating the release if needed.
+# Used by .github/workflows/release.yml (Gitea Actions).
+#
+#   GITEA_API=https://git.example.nl/api/v1/repos/owner/repo GITEA_TOKEN=… \
+#     tools/release-upload.sh v1.2.3 file…
+#
+# An asset that already exists under the same name is replaced, so a re-run
+# of the workflow (e.g. after a failed image build) is safe.
+
+set -euo pipefail
+
+TAG="${1:?tag vereist}"
+shift
+: "${GITEA_API:?GITEA_API vereist}" "${GITEA_TOKEN:?GITEA_TOKEN vereist}"
+AUTH=(-H "Authorization: token $GITEA_TOKEN")
+
+if ! release="$(curl -fsS "${AUTH[@]}" "$GITEA_API/releases/tags/$TAG")"; then
+  version="${TAG#v}"
+  body="$(python3 -I -c 'import json, sys; print(json.dumps({"tag_name": sys.argv[1], "name": "Daynivo Kiosk OS " + sys.argv[2], "body": sys.argv[3]}))' \
+    "$TAG" "$version" "Installeren of bijwerken: zie de README. Het SD-image volgt zodra het gebouwd is.")"
+  release="$(curl -fsS "${AUTH[@]}" -H "Content-Type: application/json" -d "$body" "$GITEA_API/releases")"
+fi
+id="$(python3 -I -c 'import json, sys; print(json.load(sys.stdin)["id"])' <<<"$release")"
+
+asset_id() {  # id of an existing asset with this name, or nothing
+  python3 -I -c '
+import json, sys
+release = json.load(sys.stdin)
+print(next((str(a["id"]) for a in release.get("assets") or [] if a["name"] == sys.argv[1]), ""))' "$1" <<<"$release"
+}
+
+for file in "$@"; do
+  name="$(basename "$file")"
+  old="$(asset_id "$name")"
+  if [[ -n $old ]]; then
+    curl -fsS "${AUTH[@]}" -X DELETE "$GITEA_API/releases/$id/assets/$old" >/dev/null
+  fi
+  echo "==> $name uploaden"
+  curl -fsS "${AUTH[@]}" -F "attachment=@$file" "$GITEA_API/releases/$id/assets?name=$name" >/dev/null
+done