Add a manual App Store publishing workflow

appstore.yml signs the tarball of an existing v* release and registers its
Gitea download URL with the App Store; it only runs on workflow_dispatch.
Also adds the AGPL LICENSE and points website, bugs and repository in
info.xml at the Gitea repository.

.gitea/workflows/appstore.yml

@@ -0,0 +1,84 @@
+name: Publish to App Store
+
+# Manual only: pushes an already published v* release to apps.nextcloud.com.
+# It does not build anything - it signs the exact tarball build-main.yml
+# attached to the Gitea release, because the App Store downloads the file from
+# that URL and checks the signature against it. That release only exists if
+# the checks were green, so this workflow needs no `needs:` of its own.
+#
+# Secrets:
+#   APPSTORE_PRIVATE_KEY  workflow_deck_automation.key (PEM, the key the App
+#                         Store certificate was issued for)
+#   APPSTORE_TOKEN        API token from https://apps.nextcloud.com/account/token
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release-Tag, z. B. v35.2.3'
+        required: true
+        type: string
+
+jobs:
+  appstore:
+    runs-on: gitea-runner-server03
+    permissions:
+      contents: read
+    env:
+      TAG: ${{ inputs.tag }}
+      DOWNLOAD_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/releases/download/${{ inputs.tag }}/workflow_deck_automation.tar.gz
+    steps:
+      - name: Check tag
+        run: |
+          # latest-main is rebuilt on every push, so its tarball (and signature)
+          # would not stay valid - only real version tags go to the store.
+          if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::'$TAG' is not a version tag (vX.Y.Z)"
+            exit 1
+          fi
+
+      - name: Download release tarball
+        run: |
+          # Anonymous on purpose: the App Store fetches this URL without
+          # credentials, so a private or missing release has to fail here.
+          curl -fsSL "$DOWNLOAD_URL" -o workflow_deck_automation.tar.gz
+
+      - name: Check version in tarball
+        run: |
+          VERSION=$(tar -xzOf workflow_deck_automation.tar.gz workflow_deck_automation/appinfo/info.xml \
+            | sed -n 's:.*<version>\(.*\)</version>.*:\1:p')
+          if [ "v$VERSION" != "$TAG" ]; then
+            echo "::error::info.xml says version '$VERSION', tag is '$TAG'"
+            exit 1
+          fi
+
+      - name: Sign and upload
+        env:
+          PRIVATE_KEY: ${{ secrets.APPSTORE_PRIVATE_KEY }}
+          APPSTORE_TOKEN: ${{ secrets.APPSTORE_TOKEN }}
+        run: |
+          set -e
+          if [ -z "$PRIVATE_KEY" ] || [ -z "$APPSTORE_TOKEN" ]; then
+            echo "::error::APPSTORE_PRIVATE_KEY and APPSTORE_TOKEN must be set"
+            exit 1
+          fi
+
+          KEY_FILE=$(mktemp)
+          trap 'rm -f "$KEY_FILE"' EXIT
+          chmod 600 "$KEY_FILE"
+          printf '%s\n' "$PRIVATE_KEY" > "$KEY_FILE"
+
+          # -A keeps the base64 on one line, so it can go into the JSON as is.
+          SIGNATURE=$(openssl dgst -sha512 -sign "$KEY_FILE" workflow_deck_automation.tar.gz | openssl base64 -A)
+
+          STATUS=$(curl -sS -o response.json -w '%{http_code}' -X POST \
+            -H "Authorization: Token $APPSTORE_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{\"download\":\"$DOWNLOAD_URL\",\"signature\":\"$SIGNATURE\",\"nightly\":false}" \
+            https://apps.nextcloud.com/api/v1/apps/releases)
+
+          cat response.json; echo
+          # 201 = new release, 200 = existing release replaced
+          case "$STATUS" in
+            200|201) echo "App Store accepted $TAG (HTTP $STATUS)" ;;
+            *) echo "::error::App Store answered HTTP $STATUS"; exit 1 ;;
+          esac