feat: complete OS update pipeline — extraction, notifications, CI publishing

- update.rs: extract frontend .tar.gz archives during apply (was TODO/skip)
- update.rs: back up current frontend before extraction, set binary perms
- server.rs: periodic scan reads update_state.json, sets status_info.updated
  flag and broadcasts via WebSocket so frontend gets notified automatically
- build-iso-dev.yml: publish binary + frontend archive + manifest.json with
  SHA256 hashes to /Builds/releases/v{version}/ after each build

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -143,6 +143,85 @@ jobs:
             echo "SHA256: $(sha256sum "$DEST" | cut -d' ' -f1)"
           fi
 
+      - name: Publish release artifacts and manifest
+        run: |
+          VERSION=$(grep '^version' core/archipelago/Cargo.toml | head -1 | sed 's/.*"\(.*\)".*/\1/')
+          DATE=$(date +%Y-%m-%d)
+          RELEASE_DIR="/var/lib/archipelago/filebrowser/Builds/releases/v${VERSION}"
+          sudo mkdir -p "$RELEASE_DIR"
+
+          # Copy backend binary
+          BINARY="core/target/release/archipelago"
+          if [ -f "$BINARY" ]; then
+            sudo cp "$BINARY" "$RELEASE_DIR/archipelago"
+            sudo chmod 755 "$RELEASE_DIR/archipelago"
+            echo "Backend: $(du -h "$RELEASE_DIR/archipelago" | cut -f1)"
+          fi
+
+          # Create frontend archive
+          if [ -d "web/dist/neode-ui" ]; then
+            FRONTEND_ARCHIVE="$RELEASE_DIR/archipelago-frontend-${VERSION}.tar.gz"
+            sudo tar -czf "$FRONTEND_ARCHIVE" -C web/dist neode-ui
+            echo "Frontend: $(du -h "$FRONTEND_ARCHIVE" | cut -f1)"
+          fi
+
+          # Generate manifest with SHA256 hashes
+          BACKEND_HASH=$(sha256sum "$RELEASE_DIR/archipelago" 2>/dev/null | awk '{print $1}')
+          BACKEND_SIZE=$(stat -c%s "$RELEASE_DIR/archipelago" 2>/dev/null || echo 0)
+          FRONTEND_NAME="archipelago-frontend-${VERSION}.tar.gz"
+          FRONTEND_HASH=$(sha256sum "$RELEASE_DIR/$FRONTEND_NAME" 2>/dev/null | awk '{print $1}')
+          FRONTEND_SIZE=$(stat -c%s "$RELEASE_DIR/$FRONTEND_NAME" 2>/dev/null || echo 0)
+
+          # Build download base URL (FileBrowser serves from /Builds/)
+          HOST=$(hostname -I 2>/dev/null | awk '{print $1}')
+          BASE_URL="http://${HOST:-192.168.1.228}:8083/Builds/releases/v${VERSION}"
+
+          # Get changelog from recent commits
+          CHANGELOG=$(git log --oneline -10 --format='%s' | python3 -c "
+          import sys, json
+          lines = [l.strip() for l in sys.stdin if l.strip()]
+          print(json.dumps(lines[:10]))
+          " 2>/dev/null || echo '["Update to version '"$VERSION"'"]')
+
+          python3 -c "
+          import json
+          manifest = {
+              'version': '$VERSION',
+              'release_date': '$DATE',
+              'changelog': $CHANGELOG,
+              'components': []
+          }
+          if '$BACKEND_HASH':
+              manifest['components'].append({
+                  'name': 'archipelago',
+                  'current_version': '$VERSION',
+                  'new_version': '$VERSION',
+                  'download_url': '$BASE_URL/archipelago',
+                  'sha256': '$BACKEND_HASH',
+                  'size_bytes': $BACKEND_SIZE
+              })
+          if '$FRONTEND_HASH':
+              manifest['components'].append({
+                  'name': '$FRONTEND_NAME',
+                  'current_version': '$VERSION',
+                  'new_version': '$VERSION',
+                  'download_url': '$BASE_URL/$FRONTEND_NAME',
+                  'sha256': '$FRONTEND_HASH',
+                  'size_bytes': $FRONTEND_SIZE
+              })
+          print(json.dumps(manifest, indent=2))
+          " | sudo tee "$RELEASE_DIR/manifest.json" > /dev/null
+
+          # Also copy manifest to repo releases/ dir for git-based serving
+          cp "$RELEASE_DIR/manifest.json" releases/manifest.json 2>/dev/null || true
+
+          sudo chown -R 1000:1000 "$RELEASE_DIR"
+          echo ""
+          echo "Release manifest:"
+          cat "$RELEASE_DIR/manifest.json"
+          echo ""
+          echo "Artifacts published to: $RELEASE_DIR"
+
       - name: Build report
         if: always()
         continue-on-error: true