Add self-update, including in Docker

Sandbar can install new releases itself using Reef's selfupdate, automatically with
SANDBAR_AUTO_UPDATE=1 or from a button on the Account page. In a container the new binary is
written to <data>/bin and takes over from the image at start, until the image catches up.
Tags now publish a Gitea release with archives and SHA256SUMS as well as the image.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/sandbar/server.go

@@ -26,6 +26,15 @@ type Options struct {
 	MessageDays  int // how long topic messages are kept (default 30)
 	CheckDays    int // how long monitor results are kept (default 30)
 
+	// Self-update (see update.go). Version is the running release, such as v0.2.0; anything else
+	// ("dev") never updates. Restart is called after a new binary is installed and should close
+	// what the process holds open before re-executing it.
+	Version      string
+	AutoUpdate   bool
+	UpdateServer string // default https://git.veillax.com
+	UpdateRepo   string // default Veillax/sandbar
+	Restart      func(exe string) error
+
 	// Tests replace these.
 	Now        func() time.Time
 	HTTPClient *http.Client
@@ -44,6 +53,8 @@ type Server struct {
 	loginMu  sync.Mutex
 	loginTry map[string][]time.Time
 
+	upd updateState
+
 	stop chan struct{}
 	wg   sync.WaitGroup
 }