ci(app-builder): fetch AppImage from Gitea release using token

Replace unauthenticated artifact lookup with an authenticated Gitea
release API call that fetches release JSON and asset metadata.
Require a Gitea token (with optional fallback), use it to locate the
AppImage asset in the release JSON, extract its name and download URL,
and download the file with an Authorization header.
Fail early when no token is present and verify the downloaded asset
checksum to ensure integrity; this enables access to protected releases
and improves asset selection robustness.

- Enforce token presence and use Authorization header for API calls.
- Parse release JSON to select .appimage asset and determine filename.
- Remove dependency on unauthenticated artifact base URL lookup.

.gitea/workflows/app_builder.yaml

@@ -129,7 +129,6 @@ jobs:
     environment: production
     env:
       AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
-      ARTIFACT_BASE_URL: ${{ vars.ARTIFACT_BASE_URL }}
       GITEA_API: https://git.cbsk-tech.de/api/v1
       OWNER: Christoph
       REPO: GitLite
@@ -249,16 +248,24 @@ jobs:
         run: |
           set -euo pipefail
 
-          LATEST_JSON="$(curl --fail --location --silent --show-error \
+          TOKEN="${GITEA_TOKEN:-${GITEA_FALLBACK_TOKEN:-}}"
-            "$ARTIFACT_BASE_URL/gitty/latest.json")"
+          if [ -z "$TOKEN" ]; then
-          export LATEST_JSON
+            echo "A Gitea token is required to download the AppImage" >&2
-          APPIMAGE_URL="$(node -e "const p=JSON.parse(process.env.LATEST_JSON); const a=p.platforms?.['linux-x86_64']?.url; if (!a) process.exit(1); process.stdout.write(a)")"
+            exit 1
-          APPIMAGE_NAME="${APPIMAGE_URL##*/}"
+          fi
+
+          RELEASE_JSON="$(curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
+            "$GITEA_API/repos/$OWNER/$REPO/releases/tags/$RELEASE_TAG")"
+          export RELEASE_JSON
+          APPIMAGE_URL="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.browser_download_url) process.exit(1); process.stdout.write(a.browser_download_url)")"
+          APPIMAGE_NAME="$(node -e "const r=JSON.parse(process.env.RELEASE_JSON); const a=(r.assets || []).find(a => String(a.name || '').toLowerCase().endsWith('.appimage')); if (!a?.name) process.exit(1); process.stdout.write(a.name)")"
 
           AUR_BIN_DIR="$(mktemp -d)"
           cp PKGBUILD-bin "$AUR_BIN_DIR/PKGBUILD"
           APPIMAGE_PATH="$AUR_BIN_DIR/$APPIMAGE_NAME"
           curl --fail --location --silent --show-error \
+            --header "Authorization: token $TOKEN" \
             --output "$APPIMAGE_PATH" "$APPIMAGE_URL"
           APPIMAGE_CHECKSUM="$(sha256sum "$APPIMAGE_PATH" | cut -d ' ' -f 1)"
           ICON_PATH="$AUR_BIN_DIR/gitty-desktop.png"