docs: v0.112.0 CHANGELOG + README (registry access modes) + REUSE (runner vars seam, WWW-Authenticate parser)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/README.md

@@ -1403,10 +1403,25 @@ The "Verzió és frissítés" card on the Settings page (`/settings`) shows:
 - Current version and latest available version
 - "Frissítés elérhető" (update available) badge
 - Last check time and any errors
+- Registry mode line (v0.112.0): "Registry: nyilvános (hitelesítés nélkül)" vs "Registry: hitelesített" — credential-less is a supported mode, not an error state
 - Auto-update status with configured time
 - Last update result (success/failed/pending)
 - **Buttons:** "Frissítés keresése" (check) + "Frissítés telepítése" (apply)
 
+##### Registry access modes (v0.112.0)
+
+Git Sync credentials (`git.username`/`git.token`) are **optional — for private catalogs only**; version
+discovery and self-update work without them:
+- **Anonymous (both empty):** `queryRegistry` performs the Docker Registry v2 anonymous token dance —
+  plain GET → 401 with `WWW-Authenticate` → token fetched from the ADVERTISED realm (parsed from the
+  header, never hardcoded — registry-agnostic) with no credentials → Bearer retry. `pullImage` skips
+  `docker login` entirely (docker's native anonymous flow covers public packages).
+- **Authenticated (both set):** the previous BasicAuth + login/pull/logout path, unchanged.
+- **Half-configured (only one set):** loud incomplete-credentials error — never a silent anonymous
+  downgrade.
+- A registry that genuinely denies anonymous access surfaces
+  "registry denied anonymous access — a private registry requires Git Sync credentials".
+
 After triggering an update, the page polls `/api/health` every 3s and reloads when the new container responds.
 
 A global info-level alert ("Új controller verzió elérhető") appears on all pages when an update is available, linking to the Settings page.