feat: retarget the auto-updater from Gitea to GitHub

The source repo moved to github.com/debont80/AeroFetch; the in-app
updater and release links still pointed at the old self-hosted Gitea
instance. Repoint RELEASE_API at the GitHub REST API, replace the
single-host download trust check with an allowlist (github.com plus
its release-asset CDN hosts, which GitHub 302s downloads through —
mirrors the existing FFMPEG_TRUSTED_HOSTS pattern), and add the
User-Agent header GitHub's API requires.

No bridge: installs on a Gitea-pointed build (<=0.7.3) won't
auto-discover releases published to GitHub and need one manual
download, matching the precedent set by the earlier releases-repo
migration.

src/main/config.ts

@@ -2,19 +2,27 @@
  * Build/host configuration (CC11): the deploy-specific constants that identify
  * WHERE this build talks to, separated from runtime tunables (constants.ts —
  * timeouts, caps, tickers) and from user settings (settings.ts). Retarget a
- * fork's update source by editing these three values.
+ * fork's update source by editing these values.
  *
  * The update source is the main AeroFetch repo itself, made PUBLIC — so anonymous
  * reads work and the updater sends no auth at all; there is no secret in the bundle
- * to leak. (A prior design split releases into a separate releases-only repo so the
- * source could stay private; that's retired now that the source repo is public
- * itself — one fewer moving part.) A private fork retargets its updater by editing
+ * to leak. (Earlier designs split releases into a separate releases-only repo, then
+ * moved the whole source repo off a self-hosted Gitea to GitHub — each retirement
+ * left one fewer moving part.) A private fork retargets its updater by editing
  * these constants and rebuilding.
  */
-export const UPDATE_HOST = 'https://gitea.netbird.zimspace.uk:5938'
 export const UPDATE_OWNER = 'debont80'
 export const UPDATE_REPO = 'AeroFetch'
-export const RELEASE_API = `${UPDATE_HOST}/api/v1/repos/${UPDATE_OWNER}/${UPDATE_REPO}/releases/latest`
+export const UPDATE_API_HOST = 'https://api.github.com'
+export const RELEASE_API = `${UPDATE_API_HOST}/repos/${UPDATE_OWNER}/${UPDATE_REPO}/releases/latest`
+// Hosts a release asset download may touch, HTTPS-only, re-checked on EVERY redirect
+// hop (mirrors FFMPEG_TRUSTED_HOSTS below): github.com serves browser_download_url,
+// which GitHub 302s to one of these asset-storage CDN hosts.
+export const UPDATE_TRUSTED_HOSTS = [
+  'github.com',
+  'release-assets.githubusercontent.com',
+  'objects.githubusercontent.com'
+] as const
 
 // --- ffmpeg dependency source ------------------------------------------------
 // ffmpeg/ffprobe are NOT bundled in the installer (they're the bulk of its size);