chore(migration): repoint every published link off GitHub

The canonical repo is git.zacharyzhang.com now, so every URL a user can
actually reach had to move with it.

Self-updater: `PRODUCTION_ENDPOINTS.update_base_url` targets Gitea's
`/api/v1/repos/.../releases`, which serves the same wire format GitHub's
releases API did — `Release`/asset deserialisation is unchanged. The alpha
channel requests `?per_page=30&limit=30` because GitHub reads the page size
from `per_page` and Gitea from `limit`, and each ignores the other's, so one
URL stays correct on either.

Installers: same API base, and the documented one-liners become
`https://kigicli.dev/install.{sh,ps1}`. That domain's Worker proxies both
files from Gitea raw `main`, so the published install command survives any
future forge move without being reprinted everywhere. install.ps1 also drops
the GitHub-specific `Accept: application/vnd.github+json`.

Everything else user-facing: `/feedback` and the shell's feedback fallback
point at the Gitea issue tracker, `/docs` at the Gitea-rendered README, and
web_fetch's User-Agent at kigicli.dev. SECURITY.md now routes reports to the
issue tracker with a warning to withhold exploitable detail, because Gitea
has no equivalent of GitHub's private vulnerability reporting. Comments
naming `.github/workflows/release.yml` name `.gitea/` now.

Tests assert against these constants rather than literal URLs, so they
follow automatically; the one URL-shape assertion (production endpoints are
https) still holds.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

crates/codegen/kigi-update/src/version.rs

@@ -8,9 +8,9 @@ use kigi_shell::util::kigi_home::kigi_home;
 
 const TTL_SECONDS_BEFORE_AUTO_UPDATE: Duration = Duration::from_secs(60 * 30);
 
-/// Release channel: this repo's GitHub Releases (PRD F8). The API base is
-/// resolved through [`kigi_env::update_base_url`] — production default
-/// `https://api.github.com/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
+/// Release channel: this repo's Releases (PRD F8). The API base is resolved
+/// through [`kigi_env::update_base_url`] — production default
+/// `https://git.zacharyzhang.com/api/v1/repos/ZacharyZhang-NY/Kigi-CLI/releases`,
 /// overridable via `KIGI_UPDATE_BASE_URL` for mirrors and tests.
 pub(crate) fn update_base_url() -> String {
     kigi_env::update_base_url()
@@ -167,16 +167,19 @@ async fn fetch_github_json<T: serde::de::DeserializeOwned>(url: &str) -> Result<
 
 /// Latest release for `channel` from a GitHub-Releases-shaped API at `base`.
 ///
-/// - `stable` / `enterprise`: `GET {base}/latest` — GitHub's "latest" already
-///   excludes drafts and pre-releases.
-/// - `alpha`: `GET {base}?per_page=30` (newest first) and take the semver-max
-///   non-draft entry. The list includes both pre-releases and stable
-///   releases, so this preserves the max(alpha, stable) channel semantics —
-///   alpha users are never stuck behind a newer stable.
+/// - `stable` / `enterprise`: `GET {base}/latest` — "latest" already excludes
+///   drafts and pre-releases on both GitHub and Gitea.
+/// - `alpha`: `GET {base}?per_page=30&limit=30` (newest first) and take the
+///   semver-max non-draft entry. The list includes both pre-releases and
+///   stable releases, so this preserves the max(alpha, stable) channel
+///   semantics — alpha users are never stuck behind a newer stable. GitHub
+///   reads the page size from `per_page` and Gitea from `limit`; each ignores
+///   the other's parameter, so sending both keeps one URL valid on either.
 pub async fn fetch_latest_release_from_base(channel: &str, base: &str) -> Result<Release> {
     let base = base.trim_end_matches('/');
     if channel == "alpha" {
-        let releases: Vec<Release> = fetch_github_json(&format!("{base}?per_page=30")).await?;
+        let releases: Vec<Release> =
+            fetch_github_json(&format!("{base}?per_page=30&limit=30")).await?;
         return releases
             .into_iter()
             .filter(|r| !r.draft)