feat(android): in-app updater (backend/Gitea APK), auto-bump versionCode

The app checks {backend}/api/apk/info on launch and, if a newer versionCode
than BuildConfig.VERSION_CODE is offered, shows an update dialog that
downloads {backend}/api/apk into a single wiped-each-time cache file and
hands it to the system installer (FileProvider + REQUEST_INSTALL_PACKAGES).
No APK hoarding; in-place install preserves data (stable signing key needed).

- backend /api/apk/info now returns versionCode (parsed from the release body).
- publish-apk.mjs auto-increments versionCode, sets versionName, and writes
  versionCode/versionName into the Gitea release body.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -71,6 +71,14 @@ like Android), concert events become **reliable across web/Android**, several An
 **YouTube downloads are recovered** after they broke on two independent fronts.
 
 ### Added
+- **In-app updater (Android)** — on launch the app asks the backend (`/api/apk/info`) whether a newer
+  **versionCode** than this build is available and, if so, offers "Laden & installieren": it downloads
+  the APK from `/api/apk` (which proxies the fixed Gitea release) into a single cache file, then hands
+  it to the system installer. No APK pile-up (the cache file is wiped before each download); an update
+  keeps app data / offline downloads (same package + signature = in-place install). The user still
+  confirms the system install and grants "unknown apps" once — Android requires that for sideloading.
+  `publish-apk` now **auto-increments `versionCode`** each build and writes it into the release so the
+  check is a reliable integer compare (commit the bumped `build.gradle.kts`).
 - **Android APK download in Settings (Web)** — a "🤖 Android App" section in Settings offers the
   latest APK so co-users self-serve instead of the maintainer hand-delivering builds. The button
   appears only when an APK is available and shows version/size/date. The backend serves it