Release 0.0.6: token-gated updates (M13) with encrypted storage

- updates gated to Gitea account holders via a Personal Access Token (D18
  revised: anonymous HTTP -> authenticated HTTP, since the instance requires
  sign-in for all anonymous access)
- token stored encrypted in the OS keyring (secret-tool) when available, with
  a 0600-file fallback; $RIGDOCTOR_TOKEN override; auto-migrate file->keyring
  once libsecret-tools is installed
- core/updates: token-aware fetch_latest + update_state (no-token/auth/network/
  up-to-date/available)
- CLI: rigdoctor login / logout / update [--check]
- GUI: Setup "Update access" panel (token field, get-a-token, backend status);
  sidebar update states; libsecret-tools added to the installer catalog
- token storage tests (file fallback + env override, keyring mocked)
- version 0.0.6, CHANGELOG, docs

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/MODULES.md

@@ -64,10 +64,12 @@ Status: ⬜ not started · 🟦 designing · 🟨 in progress · ✅ done
   no hosted relay), (3) **gated interactive terminal** wrapping tmate/sshx (read-only by
   default; read-write only on explicit consent — a deliberate exception to D9). Per-session
   consent, ephemeral revocable tokens, audit log.
-- **M13 Auto-update** (D18) — *check half implemented:* on GUI launch, `core/updates` queries
-  the Gitea releases API and the sidebar shows up-to-date / an "Update to v…" button / "update
-  check unavailable" (the instance currently requires sign-in for anonymous API calls). The
-  no-root **self-update** (download → verify → atomic swap → restart) is still pending.
+- **M13 Auto-update** (D18) — *check + auth implemented:* updates are **gated to Gitea account
+  holders** via a Personal Access Token, stored **encrypted in the OS keyring** (`secret-tool`)
+  with a 0600-file fallback (`config.load_token`/`save_token`/`token_backend`). `core/updates`
+  queries the releases API with the token; CLI `login`/`logout`/`update`; GUI Setup "Update
+  access" panel + sidebar states. The no-root **self-update apply** (download → verify → swap →
+  restart) and the user-local install script are still pending.
   *Original plan:* On launch, check the public Gitea releases API and
   **self-update a user-local install with no root** (download → verify checksum/signature →
   atomic symlink swap → restart, incl. the daemon). HTTPS-only, version-check-only (no