Firmware CI releases + Gitea auto-update in the server

New Gitea Actions workflow builds both board variants and publishes
them as release assets whenever firmware/version.txt is bumped. The
server can now poll that repo's releases (next to the existing manual
upload) and either surface an "Update frame" button or, with
"Automatically apply updates" checked, stage the new build itself --
the frame still only updates on its own next wake either way.

server/app/config.py

@@ -99,6 +99,22 @@ class FrameConfig(BaseModel):
     # (POST /api/firmware); "" = none uploaded yet.
     firmware_available_version: str = ""
 
+    # Gitea-hosted firmware auto-update (see app/gitea_releases.py).
+    # repo_url empty = feature off, no Gitea calls made at all.
+    # board_variant picks which release asset to pull -- must match one of
+    # the names .gitea/workflows/firmware-release-build.yml publishes
+    # (firmware-<board_variant>.bin).
+    firmware_update_repo_url: str = ""  # e.g. "https://git.example.com/owner/repo"
+    firmware_board_variant: str = "xiao"  # "xiao" or "devkit"
+    firmware_auto_update: bool = False  # pull+stage a newer release with no button click
+    # Optional Gitea PAT (read-only access is enough) for a private repo's
+    # releases; blank is fine for a public repo. GITEA_FIRMWARE_TOKEN env
+    # var overrides, mirroring MANAGEMENT_TOKEN below -- never exposed to
+    # the web UI template or any JSON response.
+    firmware_update_token: str = ""
+    firmware_update_checked_at: float = 0.0  # throttle bookkeeping, see gitea_releases.UPDATE_CHECK_INTERVAL_S
+    firmware_gitea_latest_version: str = ""  # latest release's version, from its tag name
+
     stats: FrameStats = FrameStats()
 
 
@@ -109,19 +125,22 @@ def load() -> FrameConfig:
         else:
             cfg = FrameConfig(**json.loads(CONFIG_PATH.read_text()))
 
-    # IMMICH_URL/IMMICH_API_KEY/MANAGEMENT_TOKEN set in the environment
-    # (e.g. docker-compose.yml, see docker-compose.yml.example) take
-    # precedence over whatever's saved in CONFIG_PATH, so credentials never
-    # need to go through the web UI.
+    # IMMICH_URL/IMMICH_API_KEY/MANAGEMENT_TOKEN/GITEA_FIRMWARE_TOKEN set in
+    # the environment (e.g. docker-compose.yml, see
+    # docker-compose.yml.example) take precedence over whatever's saved in
+    # CONFIG_PATH, so credentials never need to go through the web UI.
     env_url = os.environ.get("IMMICH_URL")
     env_key = os.environ.get("IMMICH_API_KEY")
     env_token = os.environ.get("MANAGEMENT_TOKEN")
+    env_gitea_token = os.environ.get("GITEA_FIRMWARE_TOKEN")
     if env_url:
         cfg.immich_url = env_url
     if env_key:
         cfg.immich_api_key = env_key
     if env_token:
         cfg.management_token = env_token
+    if env_gitea_token:
+        cfg.firmware_update_token = env_gitea_token
 
     return cfg