Release 0.0.6: token-gated updates (M13) with encrypted storage

- updates gated to Gitea account holders via a Personal Access Token (D18
  revised: anonymous HTTP -> authenticated HTTP, since the instance requires
  sign-in for all anonymous access)
- token stored encrypted in the OS keyring (secret-tool) when available, with
  a 0600-file fallback; $RIGDOCTOR_TOKEN override; auto-migrate file->keyring
  once libsecret-tools is installed
- core/updates: token-aware fetch_latest + update_state (no-token/auth/network/
  up-to-date/available)
- CLI: rigdoctor login / logout / update [--check]
- GUI: Setup "Update access" panel (token field, get-a-token, backend status);
  sidebar update states; libsecret-tools added to the installer catalog
- token storage tests (file fallback + env override, keyring mocked)
- version 0.0.6, CHANGELOG, docs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to RigDoctor are recorded here. Format follows
 (`MAJOR.MINOR.PATCH`, pre-1.0). `__version__` and `pyproject.toml` must match the git
 release tag (so the auto-updater, D18, can compare versions).
 
+## [0.0.6] - 2026-05-21
+### Added
+- **Token-gated updates (M13)**: store a Gitea Personal Access Token, **encrypted in the OS
+  keyring** (Secret Service / GNOME Keyring via `secret-tool`) with a 0600-file fallback.
+  `rigdoctor login` / `logout` / `update [--check]`; GUI **Setup → Update access** panel
+  (token field, "Get a token", backend status) and sidebar states (connect / up-to-date /
+  "Update to v…" / access denied). Updates are gated to accounts on the Gitea server (D18).
+- `libsecret-tools` added to the installer catalog (enables encrypted token storage).
+### Changed
+- D18 update mechanism revised from anonymous public HTTP to **authenticated HTTP (token)** —
+  the Gitea instance requires sign-in for all anonymous access.
+
 ## [0.0.5] - 2026-05-21
 ### Added
 - **M9 installer (first cut)**: detects distro / package manager / GPU; a catalog of optional