feat(backend): APK download proxies a fixed Gitea release (local fallback)

The /api/apk + /api/apk/info routes now fetch a fixed Gitea release
("apk-latest") server-side over the LAN and stream its .apk asset, falling
back to /data/novasonic.apk. Gitea can stay internal-only — the backend holds
the token, the browser only ever talks to the backend. Follows redirects,
constant ~30 MB (overwrite the one release's asset each build).

env: GITEA_URL, GITEA_REPO, GITEA_TOKEN (private repo only), GITEA_APK_TAG.
docker-compose documents them; unset = local-file fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -72,12 +72,17 @@ like Android), concert events become **reliable across web/Android**, several An
 
 ### Added
 - **Android APK download in Settings (Web)** — a "🤖 Android App" section in Settings offers the
-  latest APK so co-users self-serve instead of the maintainer hand-delivering builds. The backend
-  serves the staged APK (`GET /api/apk`, metadata at `/api/apk/info`); the button appears only when an
-  APK is present and shows version/size/date. **Maintainer workflow:** drop the release build into the
-  backend's data volume — `docker cp app-release.apk novasonic-backend:/data/novasonic.apk` (optional
-  `docker cp version.txt novasonic-backend:/data/novasonic.version.txt`). The Android *source* is
-  already in the repo; only build artifacts stay out of git.
+  latest APK so co-users self-serve instead of the maintainer hand-delivering builds. The button
+  appears only when an APK is available and shows version/size/date. The backend serves it
+  (`GET /api/apk`, metadata at `/api/apk/info`) from one of two sources, in order:
+  1. **A fixed Gitea release** (tag `apk-latest`) whose `.apk` asset you overwrite each build —
+     constant ~30 MB, uploadable from anywhere. The backend fetches it **server-side** over the LAN
+     (`GITEA_URL`/`GITEA_REPO`/`GITEA_TOKEN`/`GITEA_APK_TAG` env), so Gitea can stay internal-only and
+     the token never reaches the browser. Release *assets* live in Gitea's attachment store, not the
+     git history, so `clone`/`pull` stay small.
+  2. **Local fallback** — `docker cp app-release.apk novasonic-backend:/data/novasonic.apk` (optional
+     `/data/novasonic.version.txt`).
+  The Android *source* is already in the repo; only build artifacts stay out of git.
 - **Unified Global Search field (Web)** — the separate Song-Importer page/sidebar entry is gone. The
   one search field now auto-detects: a **link** (Spotify/SoundCloud/YouTube) opens the importer
   preview, plain **text** runs a Deezer search. Cleaner left nav, same behaviour as Android.