feat: add trusted mirror update source

Version checks and downloads previously depended on GitHub Release. About & Updates now offers GitHub or a validated mirror source, keeps the selector beneath the startup-check switch, and disables it when startup checks are off.

The website resolves platform downloads from a bounded OSS release index with a GitHub fallback. Tagged releases publish and verify immutable OSS assets through OIDC before switching the latest-version index; deployment requires the configured Alibaba Cloud environment variables and role.

Release note: “关于与更新”新增 GitHub 与镜像节点选择，启动检查、手动检查和下载页使用同一可信来源；官网下载也可按系统、架构和安装包类型直接选择。

src/shared/application-settings-contracts.ts

@@ -12,9 +12,16 @@ export type MagicNoteCommentMode = z.infer<
   typeof magicNoteCommentModeSchema
 >
 
+export const updateSourceSchema = z.enum([
+  'github',
+  'mirror'
+])
+export type UpdateSource = z.infer<typeof updateSourceSchema>
+
 const applicationPreferencesSchema = z
   .object({
     checkUpdatesOnStartup: z.boolean(),
+    updateSource: updateSourceSchema,
     magicNotesEnabled: z.boolean(),
     magicNoteCommentMode: magicNoteCommentModeSchema,
     magicNoteCommentFormat: magicNoteCommentFormatSchema

src/shared/goodbuddy-config-contracts.test.ts

@@ -133,6 +133,7 @@ describe('GoodBuddy configuration contracts', () => {
     const snapshot = {
       application: {
         checkUpdatesOnStartup: true,
+        updateSource: 'github',
         magicNotesEnabled: true,
         magicNoteCommentMode: 'immediate',
         magicNoteCommentFormat: 'combined'