feat: retarget the auto-updater from Gitea to GitHub

The source repo moved to github.com/debont80/AeroFetch; the in-app
updater and release links still pointed at the old self-hosted Gitea
instance. Repoint RELEASE_API at the GitHub REST API, replace the
single-host download trust check with an allowlist (github.com plus
its release-asset CDN hosts, which GitHub 302s downloads through —
mirrors the existing FFMPEG_TRUSTED_HOSTS pattern), and add the
User-Agent header GitHub's API requires.

No bridge: installs on a Gitea-pointed build (<=0.7.3) won't
auto-discover releases published to GitHub and need one manual
download, matching the precedent set by the earlier releases-repo
migration.

test/updaterDownload.test.ts

@@ -73,7 +73,8 @@ import type { WebContents } from 'electron'
 
 // --- helpers ------------------------------------------------------------------
 
-const HOST = 'https://gitea.netbird.zimspace.uk:5938'
+const HOST = 'https://github.com'
+const CDN_HOST = 'https://release-assets.githubusercontent.com'
 const ASSET = `${HOST}/debont80/AeroFetch/releases/download/v9.9.9/AeroFetch-Setup-9.9.9.exe`
 const INSTALLER = Buffer.from('FAKE-INSTALLER-BYTES-'.repeat(64))
 const GOOD_SHA = createHash('sha256').update(INSTALLER).digest('hex')
@@ -213,6 +214,21 @@ describe('downloadAppUpdate (CL4 behavior pins)', () => {
     expect(madeRequests[1]!.redirectsFollowed).toBe(1)
   })
 
+  it('follows a redirect to the allowlisted asset CDN host (github.com → githubusercontent.com)', async () => {
+    requestScripts.push(checksumOk(`${GOOD_SHA}  AeroFetch-Setup-9.9.9.exe\n`))
+    requestScripts.push((req) => {
+      req.emit('redirect', 302, 'GET', `${CDN_HOST}/github-production-release-asset/abc123`)
+      const res = new FakeResponse(200, { 'content-length': String(INSTALLER.length) })
+      req.emit('response', res)
+      res.emit('data', INSTALLER)
+      res.emit('end')
+    })
+    const { wc } = fakeWc()
+    const r = await downloadAppUpdate(wc, ASSET)
+    expect(r.ok).toBe(true)
+    expect(madeRequests[1]!.redirectsFollowed).toBe(1)
+  })
+
   it('refuses a checksum-fetch redirect off the trusted host', async () => {
     requestScripts.push((req) => {
       req.emit('redirect', 302, 'GET', 'https://evil.example/x.sha256')