chore(migration): repoint every published link off GitHub

The canonical repo is git.zacharyzhang.com now, so every URL a user can
actually reach had to move with it.

Self-updater: `PRODUCTION_ENDPOINTS.update_base_url` targets Gitea's
`/api/v1/repos/.../releases`, which serves the same wire format GitHub's
releases API did — `Release`/asset deserialisation is unchanged. The alpha
channel requests `?per_page=30&limit=30` because GitHub reads the page size
from `per_page` and Gitea from `limit`, and each ignores the other's, so one
URL stays correct on either.

Installers: same API base, and the documented one-liners become
`https://kigicli.dev/install.{sh,ps1}`. That domain's Worker proxies both
files from Gitea raw `main`, so the published install command survives any
future forge move without being reprinted everywhere. install.ps1 also drops
the GitHub-specific `Accept: application/vnd.github+json`.

Everything else user-facing: `/feedback` and the shell's feedback fallback
point at the Gitea issue tracker, `/docs` at the Gitea-rendered README, and
web_fetch's User-Agent at kigicli.dev. SECURITY.md now routes reports to the
issue tracker with a warning to withhold exploitable detail, because Gitea
has no equivalent of GitHub's private vulnerability reporting. Comments
naming `.github/workflows/release.yml` name `.gitea/` now.

Tests assert against these constants rather than literal URLs, so they
follow automatically; the one URL-shape assertion (production endpoints are
https) still holds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

crates/codegen/kigi-env/src/lib.rs

@@ -11,7 +11,8 @@ pub struct KigiEndpoints {
     pub coding_api_base_url: &'static str,
     /// OAuth device-flow host for Kimi Code subscription login.
     pub oauth_host: &'static str,
-    /// GitHub Releases API endpoint the self-updater polls.
+    /// Releases API endpoint the self-updater polls (GitHub-Releases-shaped;
+    /// Gitea's `/api/v1` serves the same wire format).
     pub update_base_url: &'static str,
     /// Human-facing page for subscription upgrade guidance.
     pub upgrade_page_url: &'static str,
@@ -20,7 +21,7 @@ pub struct KigiEndpoints {
 pub const PRODUCTION_ENDPOINTS: KigiEndpoints = KigiEndpoints {
     coding_api_base_url: "https://api.kimi.com/coding/v1",
     oauth_host: "https://auth.kimi.com",
-    update_base_url: "https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases",
+    update_base_url: "https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases",
     upgrade_page_url: "https://www.kimi.com/code/",
 };
 
@@ -29,7 +30,7 @@ pub const CODE_BASE_URL_ENV: &str = "KIGI_CODE_BASE_URL";
 /// Env var overriding [`oauth_host`] (PRD F1).
 pub const OAUTH_HOST_ENV: &str = "KIGI_OAUTH_HOST";
 /// Env var overriding [`update_base_url`] (PRD F8). Points the self-updater
-/// at an alternate GitHub-Releases-shaped API (mirrors, tests).
+/// at an alternate GitHub/Gitea-Releases-shaped API (mirrors, tests).
 pub const UPDATE_BASE_URL_ENV: &str = "KIGI_UPDATE_BASE_URL";
 
 fn resolve(var: &str, compiled: &'static str) -> String {