Make the update check immune to GitHub rate limiting, refresh the About icons

[Renakoni]

Findings from the owner's post-release phone test of v0.2.0, on the About page.

1. "Could not check updates (403)" — diagnosed, then solved outright

Diagnosis — environmental, not a client bug. The checker called GitHub's releases/latest API unauthenticated, which is limited to 60 requests/hour per source IP. The phone was on a VPN: the shared exit IP's pool was exhausted by other clients on that node, and GitHub answers 403. Evidence: the identical request from this machine returns 200 with X-RateLimit-Limit: 60, and the same build returned "latest version" on the emulator over a different egress. A public client cannot ship a token, so the API quota itself cannot be raised.

The complete fix — stop depending on the API at all. On Android the check now asks the native layer first: AppUpdateChecker (pure JVM over the existing HttpTransport seam, which already surfaces redirects unfollowed) issues one GET to github.com/…/releases/latest and reads the release tag from the Location header of the redirect. The web endpoint is not behind the API quota, so the check works on shared-egress networks where the API refuses. Hardening: refuses non-redirects, locationless responses, and any target outside this repository's tag page (the URL is later opened in a browser and must never be attacker-shaped); strips query/fragment, URL-decodes the tag, bounds the probe body at 64 KB.

Defense in depth kept. The API fetch remains the browser-shell path and the fallback for any native failure; there, 403/429 now maps to a localized rate-limit explanation (×10 locales) instead of a bare status code, and the releases-page link row appears after any failed check as the manual path.

Plumbing: UrlConnectionTransport moves out of CloudDocumentsPlugin into a shared package-private class; AndroidAppInfo gains getLatestRelease on a single-thread executor; the web wrapper (src/lib/androidAppInfo.ts) becomes the plugin's single registration point (Capacitor rejects duplicate names), and advancedDiagnostics reuses it.

2. About icons

• External-link glyph: the old geometry ran the arrow strokes within ~1 SVG unit of the box outline; at 24 px with a 2.1 stroke the sub-stroke gaps fused into the smudge visible in the report. Redrawn with the conventional layout (box bottom-left, arrow exiting the open corner) — no stroke pair closer than 3 units.
• GitHub row: the code-brackets glyph read as "source code", not GitHub; the row now carries the Octicons mark-github Octocat (MIT-licensed glyph; GitHub permits the mark as a link to a repository). Filled shape, so it opts out of the shared stroke styling at a balanced 24 px.

Verification

• JVM: 121 green (+5 AppUpdateCheckerTest: redirect parse, relative-Location + query/fragment/URL-decode handling, refusal of the no-releases redirect and foreign hosts, refusal of non-redirect/locationless responses, bounded probe + Accept header).
• Web: 684 tests green (+1 rate-limit mapping), vue-tsc -b + Vite build green, focused lint clean, locale contract satisfied.
• e2e mobile-home-navigation 2/2 (browser shell keeps the fetch path: link hidden before a check, shown with the right href after a mocked available result).
• Emulator (API 35, debug build): About → Check updates → "You are on the latest version" with logcat showing the AndroidAppInfo.getLatestRelease native call and zero api.github.com traffic — the tag came from the redirect. Screenshot-verified the Octocat row and the redrawn external-link glyph.

Notes

• Current installs (v0.1.0/v0.2.0) still use the API path; their 403 clears when the VPN exit rotates or the hour window resets. From the next release on, the check no longer touches the API on devices.