feat: releases from GitHub first, then git.kebcloud.no; releases sets others

Updates and install.sh try the GitHub mirror, then git.kebcloud.no,
each with a short timeout, and download from the first server with the
release, checked against its checksums.txt. The releases config option
(and LAZYSECRETS_RELEASES for install.sh) lists other servers. The
release workflow copies each release to GitHub when GH_RELEASE_TOKEN is
set. The status pane's issues link points to GitHub.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/update/update_test.go

@@ -70,13 +70,13 @@ func server(t *testing.T, tamper bool) *httptest.Server {
 		sum[0] ^= 0xff
 	}
 	mux := http.NewServeMux()
-	mux.HandleFunc("/api/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/api/v1/repos/keb/lazysecrets/releases/latest", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprint(w, `{"tag_name":"v0.2.0","body":"### Added\n\n- x\n\n## Install\n","html_url":"https://example.com/r"}`)
 	})
-	mux.HandleFunc("/repo/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/checksums.txt", func(w http.ResponseWriter, _ *http.Request) {
 		fmt.Fprintf(w, "%s  %s.tar.gz\n", hex.EncodeToString(sum[:]), name)
 	})
-	mux.HandleFunc("/repo/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
+	mux.HandleFunc("/keb/lazysecrets/releases/download/v0.2.0/"+name+".tar.gz", func(w http.ResponseWriter, _ *http.Request) {
 		w.Write(archive.Bytes())
 	})
 	srv := httptest.NewServer(mux)
@@ -89,7 +89,7 @@ func TestInstall(t *testing.T) {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, false)
-	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
+	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
 	r, err := c.Latest(context.Background())
 	if err != nil || r.Tag != "v0.2.0" {
 		t.Fatalf("latest %+v %v", r, err)
@@ -107,12 +107,59 @@ func TestInstall(t *testing.T) {
 	}
 }
 
+// A server that's down, or doesn't have the release, is skipped.
+func TestFallsBackToTheNextServer(t *testing.T) {
+	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
+		t.Skip("releases are for macOS and Linux")
+	}
+	down := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "down", http.StatusBadGateway)
+	}))
+	t.Cleanup(down.Close)
+	srv := server(t, false)
+	c := &Client{Servers: []string{down.URL + "/keb/lazysecrets", srv.URL + "/keb/lazysecrets"}}
+	r, err := c.Latest(context.Background())
+	if err != nil || r.Tag != "v0.2.0" {
+		t.Fatalf("latest %+v %v", r, err)
+	}
+	exe := filepath.Join(t.TempDir(), "lazysecrets")
+	os.WriteFile(exe, []byte("old"), 0o755)
+	if err := c.Install(context.Background(), r, exe); err != nil {
+		t.Fatal(err)
+	}
+	if b, _ := os.ReadFile(exe); !strings.Contains(string(b), "echo lazysecrets 0.2.0") {
+		t.Errorf("not replaced: %q", b)
+	}
+
+	// Every server down: both say why.
+	c = &Client{Servers: []string{down.URL + "/a/b", down.URL + "/c/d"}}
+	if _, err := c.Latest(context.Background()); err == nil || strings.Count(err.Error(), "502") != 2 {
+		t.Errorf("all down: %v", err)
+	}
+}
+
+func TestAPI(t *testing.T) {
+	for repo, want := range map[string]string{
+		"https://github.com/karleinarb/lazysecrets":   "https://api.github.com/repos/karleinarb/lazysecrets",
+		"https://git.kebcloud.no/keb/lazysecrets/":    "https://git.kebcloud.no/api/v1/repos/keb/lazysecrets",
+		"https://codeberg.org/someone/lazysecrets":    "https://codeberg.org/api/v1/repos/someone/lazysecrets",
+		"https://git.kebcloud.no/keb":                 "",
+		"git.kebcloud.no/keb/lazysecrets":             "",
+		"https://github.com/karleinarb/lazysecrets/x": "",
+	} {
+		got, err := API(repo)
+		if got != want || (err != nil) != (want == "") {
+			t.Errorf("API(%q) = %q, %v", repo, got, err)
+		}
+	}
+}
+
 func TestInstallRefusesATamperedArchive(t *testing.T) {
 	if runtime.GOOS != "darwin" && runtime.GOOS != "linux" {
 		t.Skip("releases are for macOS and Linux")
 	}
 	srv := server(t, true)
-	c := &Client{API: srv.URL + "/api", Repo: srv.URL + "/repo"}
+	c := &Client{Servers: []string{srv.URL + "/keb/lazysecrets"}}
 	exe := filepath.Join(t.TempDir(), "lazysecrets")
 	os.WriteFile(exe, []byte("old"), 0o755)
 	err := c.Install(context.Background(), Release{Tag: "v0.2.0"}, exe)