Add opt-in auto-update from Gitea releases

The program now lives in /usr/local/lib/blacktip and is owned by its service user so it can replace itself.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

deploy/blacktip.service

@@ -10,7 +10,7 @@ Group=blacktip
 # The Traefik that ships with Blacktip; set BLACKTIP_TRAEFIK= (empty) in the env file for the built-in proxy.
 Environment=BLACKTIP_TRAEFIK=/usr/local/lib/blacktip/traefik
 EnvironmentFile=-/etc/blacktip/blacktip.env
-ExecStart=/usr/local/bin/blacktip -data /var/lib/blacktip
+ExecStart=/usr/local/lib/blacktip/blacktip -data /var/lib/blacktip
 WorkingDirectory=/var/lib/blacktip
 Restart=on-failure
 RestartSec=3
@@ -22,7 +22,7 @@ AmbientCapabilities=CAP_NET_BIND_SERVICE
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 NoNewPrivileges=true
 ProtectSystem=strict
-ReadWritePaths=/var/lib/blacktip
+ReadWritePaths=/var/lib/blacktip /usr/local/lib/blacktip
 ProtectHome=true
 PrivateTmp=true
 ProtectKernelTunables=true