feat: add safe Gitea sync and signed updates

tests/repository-monitor.test.mjs

@@ -102,3 +102,47 @@ test('a watched repository is read on filesystem activity instead of on every in
   monitor.stop();
   assert.equal(monitor.watchers.size, 0, 'stopping releases every watcher');
 });
+
+test('background Gitea awareness fetches read-only remote state with bounded concurrency', async () => {
+  let active = 0;
+  let peak = 0;
+  const changes = [];
+  const git = {
+    fetch: async (localPath) => {
+      active += 1;
+      peak = Math.max(peak, active);
+      await new Promise((resolve) => setTimeout(resolve, 15));
+      active -= 1;
+      return { status: { localPath, revision: 2, branch: { head: 'main', ahead: 0, behind: 1 }, counts: {} } };
+    },
+    statusFingerprint: (status) => String(status.revision),
+  };
+  const store = { data: { preferences: { autoRefresh: true, repositoryPollSeconds: 2, fetchIntervalMinutes: 1 } } };
+  const monitor = new RepositoryMonitor({ store, git, onChange: (change) => changes.push(change) });
+  const paths = Array.from({ length: 6 }, (_, index) => `/repo-${index}`);
+  monitor.setPaths(paths);
+  for (const localPath of paths) {
+    monitor.fingerprints.set(localPath, '1');
+    monitor.lastFetchedAt.set(localPath, Date.now() - 61_000);
+  }
+
+  await monitor.fetchRemoteUpdates();
+  assert.equal(peak, 2);
+  assert.equal(active, 0);
+  assert.equal(changes.length, paths.length);
+  assert.ok(changes.every((change) => change.reason === 'remote-state-changed'));
+});
+
+test('a zero remote fetch interval disables background network access', async () => {
+  let fetches = 0;
+  const git = {
+    fetch: async () => { fetches += 1; return { status: { revision: 2 } }; },
+    statusFingerprint: (status) => String(status.revision),
+  };
+  const store = { data: { preferences: { autoRefresh: true, repositoryPollSeconds: 2, fetchIntervalMinutes: 0 } } };
+  const monitor = new RepositoryMonitor({ store, git });
+  monitor.setPaths(['/repo']);
+  monitor.lastFetchedAt.set('/repo', 0);
+  await monitor.fetchRemoteUpdates(Date.now() + 24 * 60 * 60_000);
+  assert.equal(fetches, 0);
+});