App 2.16.0, server 2.6.0: over-the-air updates from our own repository

The car updates itself again, from this fork's own releases, while the
repository stays private:

- publish-car (flake) creates the pre-release car-<version> on the
  forge and attaches the APK and its .sha256. It needs a forge token
  that may write releases, from ~/.config/nilsmg4/forge-token or
  $FORGE_TOKEN; it is sent in a header and never printed.
- The server relays releases and attachments (/v1/app/releases,
  /v1/app/assets/...), read with a read-only FORGE_TOKEN from its
  Secret, GitHub-shaped with download URLs back at itself. Redirects
  away from the forge are not followed; off (404) without a token.
- The app asks its server with its own paired token, allows exactly
  the server's host, downloads the APK itself instead of through the
  DownloadManager (so the token stays in the app), verifies SHA-256 and
  package name, and tries a PackageInstaller session (it may install
  silently as the system user) before falling back to Downloads.

OTA.md is rewritten for this flow; the k8s and server READMEs explain
the new token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

flake.nix

@@ -109,10 +109,62 @@
               echo "  adb shell \"pm install -r -f -d -t /data/local/tmp/update.apk\""
             '';
           };
+
+          # Publishes the current car build as a pre-release on the forge, where the car
+          # server relays it to the in-app updater (server/releases.go, OTA.md). Needs a forge
+          # token with write access to the repository's releases, from $FORGE_TOKEN or
+          # ~/.config/nilsmg4/forge-token; it is sent in a header and never printed.
+          publishCar = pkgs.writeShellApplication {
+            name = "publish-car";
+            runtimeInputs = [ pkgs.curl pkgs.jq pkgs.coreutils pkgs.git ];
+            text = ''
+              forge=''${FORGE_URL:-https://git.stinnesbeck.com}
+              repo=''${FORGE_REPO:-nils/mg4}
+              token=''${FORGE_TOKEN:-}
+              if [ -z "$token" ] && [ -f "$HOME/.config/nilsmg4/forge-token" ]; then
+                token=$(tr -d '[:space:]' < "$HOME/.config/nilsmg4/forge-token")
+              fi
+              if [ -z "$token" ]; then
+                echo "publish-car: no token. Put one in ~/.config/nilsmg4/forge-token (or \$FORGE_TOKEN)." >&2
+                exit 1
+              fi
+              root=$(git rev-parse --show-toplevel)
+              cd "$root"
+              version=$(grep -m1 'versionName "' app/build.gradle | sed 's/.*versionName "\(.*\)".*/\1/')
+              apk="build/car/NilsMG4-unstable-$version.apk"
+              if [ ! -f "$apk" ] || [ ! -f "$apk.sha256" ]; then
+                echo "publish-car: $apk (and .sha256) not found; run build-car first" >&2
+                exit 1
+              fi
+              if [ "$(sha256sum "$apk" | cut -d' ' -f1)" != "$(cat "$apk.sha256")" ]; then
+                echo "publish-car: $apk does not match its .sha256" >&2
+                exit 1
+              fi
+              tag="car-$version"
+              commit=$(git rev-parse HEAD)
+              api="$forge/api/v1/repos/$repo"
+              auth=(-H "Authorization: token $token")
+
+              if curl -sSf "''${auth[@]}" "$api/releases/tags/$tag" >/dev/null 2>&1; then
+                echo "publish-car: $tag already exists; bump the version before publishing again" >&2
+                exit 1
+              fi
+              body=$(jq -n --arg tag "$tag" --arg commit "$commit" --arg name "Car build $version" \
+                '{tag_name: $tag, target_commitish: $commit, name: $name, prerelease: true,
+                  body: "Platform-signed car build, installed by the in-app updater."}')
+              id=$(curl -sSf "''${auth[@]}" -H "Content-Type: application/json" -d "$body" \
+                "$api/releases" | jq -r .id)
+              for f in "$apk" "$apk.sha256"; do
+                curl -sSf "''${auth[@]}" -F "attachment=@$f" \
+                  "$api/releases/$id/assets?name=$(basename "$f")" >/dev/null
+              done
+              echo "Published $tag ($(basename "$apk") and .sha256) at $forge/$repo/releases/tag/$tag"
+            '';
+          };
         in
         {
           default = pkgs.mkShell {
-            packages = [ jdk android.androidsdk buildCar pkgs.go pkgs.gopls pkgs.govulncheck pkgs.influxdb2-server pkgs.influxdb2-cli ];
+            packages = [ jdk android.androidsdk buildCar publishCar pkgs.go pkgs.gopls pkgs.govulncheck pkgs.influxdb2-server pkgs.influxdb2-cli ];
 
             ANDROID_HOME = sdk;
             ANDROID_SDK_ROOT = sdk;
@@ -126,6 +178,7 @@
               echo "  ./gradlew assembleStableDebug     # debug APK"
               echo "  ./gradlew assembleUnstableDebug   # build that can update itself (OTA)"
               echo "  build-car                         # unstable build signed for the car"
+              echo "  publish-car                       # publish it for the in-app updater"
             '';
           };
         });