feat(updater): bake a read-only update token into the build

The release repo is private, so the auto-updater previously required each
user to paste a Gitea token into Settings before it could see or download
updates. Inject a read-only token at build time (AEROFETCH_UPDATE_TOKEN env
var or a gitignored .update-token file) via electron.vite's `define`, and
fall back to it in authHeader() when the user hasn't set their own. The token
value lives only in the built bundle, never in source or git.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/main/config.ts

@@ -4,12 +4,33 @@
  * timeouts, caps, tickers) and from user settings (settings.ts). Retarget a
  * fork's update source by editing these three values.
  *
- * IMPORTANT: the update repo's releases must be ANONYMOUSLY readable — i.e. a
- * public repo on a Gitea instance that permits anonymous API + downloads.
- * AeroFetch never ships a token; on a sign-in-required instance the update
+ * The update repo is PRIVATE, so the release API + downloads require a token.
+ * A build-time read-only token (BAKED_UPDATE_TOKEN below) lets a shipped client
+ * reach it without the user configuring anything; a user-set updateToken in
+ * Settings still takes precedence. On a build with no token baked in, the update
  * check simply reports that it couldn't reach the server.
  */
 export const UPDATE_HOST = 'https://gitea.netbird.zimspace.uk:5938'
 export const UPDATE_OWNER = 'debont80'
 export const UPDATE_REPO = 'AeroFetch'
 export const RELEASE_API = `${UPDATE_HOST}/api/v1/repos/${UPDATE_OWNER}/${UPDATE_REPO}/releases/latest`
+
+/**
+ * Read-only Gitea token baked in at build time so the auto-updater can read the
+ * PRIVATE release repo without each user pasting a token into Settings. Injected
+ * by electron.vite.config's `define` from the AEROFETCH_UPDATE_TOKEN env var (or a
+ * gitignored .update-token file) — so the real value lives only in the built
+ * bundle, never in source or git.
+ *
+ * SECURITY: a shipped client is decompilable, so treat this as PUBLIC. It MUST be
+ * a token from a dedicated service account with read-only access to ONLY this repo
+ * — never a personal/push-capable token. The user's own updateToken overrides it
+ * (see authHeader in updater.ts), so a private fork can point elsewhere.
+ *
+ * `__AEROFETCH_UPDATE_TOKEN__` is a `define`-replaced literal in built code; under
+ * plain vitest (no define) the identifier is undeclared, so the `typeof` guard
+ * keeps this from throwing and falls back to empty (no token).
+ */
+declare const __AEROFETCH_UPDATE_TOKEN__: string
+export const BAKED_UPDATE_TOKEN: string =
+  typeof __AEROFETCH_UPDATE_TOKEN__ === 'string' ? __AEROFETCH_UPDATE_TOKEN__ : ''