hub v0.29.0: Day-0 artifact manifest — version dropdowns + auto-derived sha

Operator picks a version from a Gitea-populated dropdown; the hub reads that
version's sha256 from Gitea itself (files-metadata API, no artifact download) and
vouches it — no hand-copied checksums. New internal/gitea read-only client
(ListVersions + FileSHA256, unit-tested). Configuration UI: version <select>s +
read-only sha display; handleSetArtifacts derives the sha authoritatively and
refuses the save on a Gitea lookup failure. Degrades to manual text entry without
registry creds. go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/cmd/hub/main.go

@@ -14,6 +14,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-hub/internal/api"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/assets"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/gitea"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/mailrelay"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/monitor"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
@@ -254,6 +255,13 @@ func main() {
 	webServer := web.New(dataStore, cfg.Auth.PasswordHash, cfg.API.ReportAPIKey, Version, staleThreshold, logger)
 	webServer.SetTemplateFetcher(templateFetcher)
 	webServer.SetAssetManager(assetsMgr)
+	// Day-0 artifact version dropdowns: let the operator pick a version and have the hub derive the
+	// sha256 from Gitea (no hand-copied checksums). Reuses the registry creds; degrades to manual text
+	// entry when they're absent.
+	if cfg.Registry.Username != "" && cfg.Registry.Token != "" {
+		webServer.SetGiteaClient(gitea.New("https://gitea.dooplex.hu", "admin", cfg.Registry.Username, cfg.Registry.Token))
+		logger.Printf("[INFO] Gitea artifact browser enabled (Day-0 version dropdowns)")
+	}
 
 	// Build HTTP mux
 	mux := http.NewServeMux()