docs: v0.112.0 CHANGELOG + README (registry access modes) + REUSE (runner vars seam, WWW-Authenticate parser)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,33 @@
 ## Changelog
 
+### v0.112.0 — self-update without credentials: anonymous registry mode (2026-07-10)
+
+Root cause (live on Peti's box): the updater piggybacked on the Git Sync credentials and REFUSED when
+they were absent — but the registry serves the public package anonymously (Docker v2 token dance,
+verified empirically). A fresh customer without a private catalog silently lost version discovery +
+self-update for no reason. Credentials become what they were meant to be: optional, private-catalog only.
+
+- **`queryRegistry` (internal/selfupdate):** both creds empty → anonymous mode — plain GET; on 401
+  parse `WWW-Authenticate` (realm + service FROM THE HEADER — never hardcoded, quoted/bare/any-order/
+  comma-in-quotes handled); GET the realm with `service` + `repository:<image>:pull` scope and NO
+  credentials; retry tags/list with the Bearer. Creds present → the BasicAuth path unchanged.
+  Half-configured pair → loud "hiányos registry hitelesítő adatok". A genuinely-denying registry →
+  "registry denied anonymous access — a private registry requires Git Sync credentials" (never the old
+  "credentials missing"). The registry base URL now derives from the image ref (was hardcoded host).
+- **`pullImage`:** no creds → the `docker login` step is skipped entirely (docker's native anonymous
+  flow covers public packages); creds → login/pull/logout unchanged (token still stdin-only).
+- **Settings page truthfulness:** "Verzió és frissítés" gains a mode line — "Registry: nyilvános
+  (hitelesítés nélkül)" vs "Registry: hitelesített"; credential-less is no longer an error state; the
+  Hiba row appears only on a real failure. `DryRun.PullCapable` counts anonymous as capable.
+- Tests (`registry_anon_test.go`, httptest fake registry + fake CLI runner): full anonymous dance with
+  ZERO creds (token request auth-free, correct scope, highest semver); creds path byte-shape unchanged
+  (BasicAuth, no dance); both denial paths (token 401 / tags-with-Bearer 401) → the new clear error;
+  WWW-Authenticate parser table; pull with no creds → no login invocation recorded, pull still invoked;
+  creds → login/pull/logout order + stdin token; partial creds refuse everywhere. **Red-proof:** old
+  creds-required guard restored → all three anonymous tests FAIL with
+  "registry hitelesítő adatok hiányoznak" visible. Restored green.
+- Pairs with hub v0.43.1 (Git Sync form hint: "Opcionális — csak privát alkalmazás-katalógushoz…").
+
 ### v0.111.0 — remote app-log diagnostics: error context + on-demand log tails (2026-07-10)
 
 Extends the app-telemetry pipeline with what the live Peti support session lacked: readable error