feat(backend): APK download proxies a fixed Gitea release (local fallback)

The /api/apk + /api/apk/info routes now fetch a fixed Gitea release
("apk-latest") server-side over the LAN and stream its .apk asset, falling
back to /data/novasonic.apk. Gitea can stay internal-only — the backend holds
the token, the browser only ever talks to the backend. Follows redirects,
constant ~30 MB (overwrite the one release's asset each build).

env: GITEA_URL, GITEA_REPO, GITEA_TOKEN (private repo only), GITEA_APK_TAG.
docker-compose documents them; unset = local-file fallback.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -33,6 +33,12 @@ services:
       - MAX_PARALLEL=${MAX_PARALLEL:-2}
       - DOWNLOAD_BACKEND=${DOWNLOAD_BACKEND:-ytdlp}
       - TICKETMASTER_API_KEY=${TICKETMASTER_API_KEY}
+      # Android APK download button — backend proxies a fixed Gitea release ("apk-latest"), same LAN.
+      # Optional: leave unset to use the local /data/novasonic.apk fallback instead.
+      - GITEA_URL=${GITEA_URL:-}                 # internal Gitea base, e.g. http://gitea:3000
+      - GITEA_REPO=${GITEA_REPO:-}               # owner/repo, e.g. Docker/NovaSonic
+      - GITEA_TOKEN=${GITEA_TOKEN:-}             # read token (only for a private repo)
+      - GITEA_APK_TAG=${GITEA_APK_TAG:-apk-latest}
     command: >
       sh -c "
         apt-get update && apt-get install -y --no-install-recommends python3 python3-pip ffmpeg curl git unzip && rm -rf /var/lib/apt/lists/* &&