Server 2.6.2: log update checks and downloads; Go 1.27.3

The update relay logs every check (car, number of releases, newest
pre-release) and every download (car, file, size, then bytes and time,
or that it was cut short); never the forge's address or token, tested.
Go 1.27.3 for the build image and toolchain: govulncheck had found
GO-2026-6809 in crypto/x509 under 1.26.9; source and binary now clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhzAVaUyqcw5PkGjz4mWW6

SPECS.md

@@ -138,6 +138,14 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-25 — Server 2.6.2: **the update relay logs what it hands out**, per car (installation
+  ID, or "shared token"): `update check` with the number of releases and the newest
+  pre-release, `update download started` with file and size, then `update handed out` with
+  bytes and time, or `update download cut short`; refusals by the forge name the car too. No
+  forge address or token in the log (tested: `TestUpdatesAreLogged`). Go 1.27.3 (build image
+  and `go.mod` toolchain), up from 1.26.9: `govulncheck` had found GO-2026-6809 (compromised
+  intermediate certificates, `crypto/x509`, reached through the server's TLS); now no
+  vulnerabilities, in the source and in the built binary. go vet, tests, podman build.
 - 2026-10-25 — `k8s/influxdb.yaml`: the values Kubernetes fills in itself are written out — the
   NetworkPolicy port's `protocol: TCP`, and `apiVersion`, `kind` and `volumeMode: Filesystem` on
   the StatefulSet's volume claim template. Without them every `kubectl apply -k k8s/` reported