feat(desktop): add client release updater

server/internal/shared/config/config.go

@@ -285,14 +285,17 @@ type QdrantConfig struct {
 }
 
 type ObjectStorageConfig struct {
-	Provider      string `mapstructure:"provider"`
-	Endpoint      string `mapstructure:"endpoint"`
-	AccessKey     string `mapstructure:"access_key"`
-	SecretKey     string `mapstructure:"secret_key"`
-	Bucket        string `mapstructure:"bucket"`
-	UseSSL        bool   `mapstructure:"use_ssl"`
-	PublicBaseURL string `mapstructure:"public_base_url"`
-	Region        string `mapstructure:"region"`
+	Provider      string        `mapstructure:"provider"`
+	Endpoint      string        `mapstructure:"endpoint"`
+	AccessKey     string        `mapstructure:"access_key"`
+	SecretKey     string        `mapstructure:"secret_key"`
+	Bucket        string        `mapstructure:"bucket"`
+	UseSSL        bool          `mapstructure:"use_ssl"`
+	PublicBaseURL string        `mapstructure:"public_base_url"`
+	BucketACL     string        `mapstructure:"bucket_acl"`
+	ObjectACL     string        `mapstructure:"object_acl"`
+	SignedURLTTL  time.Duration `mapstructure:"signed_url_ttl"`
+	Region        string        `mapstructure:"region"`
 }
 
 type JWTConfig struct {
@@ -956,6 +959,15 @@ func applyEnvOverrides(cfg *Config) {
 	if publicBaseURL, ok := lookupNonEmptyEnv("OBJECT_STORAGE_PUBLIC_BASE_URL"); ok {
 		cfg.ObjectStorage.PublicBaseURL = publicBaseURL
 	}
+	if bucketACL, ok := lookupNonEmptyEnv("OBJECT_STORAGE_BUCKET_ACL"); ok {
+		cfg.ObjectStorage.BucketACL = bucketACL
+	}
+	if objectACL, ok := lookupNonEmptyEnv("OBJECT_STORAGE_OBJECT_ACL"); ok {
+		cfg.ObjectStorage.ObjectACL = objectACL
+	}
+	if ttl, ok := lookupDurationEnv("OBJECT_STORAGE_SIGNED_URL_TTL"); ok {
+		cfg.ObjectStorage.SignedURLTTL = ttl
+	}
 	if region, ok := lookupNonEmptyEnv("OBJECT_STORAGE_REGION"); ok {
 		cfg.ObjectStorage.Region = region
 	}

server/internal/shared/config/config_test.go

@@ -108,6 +108,34 @@ retrieval:
 	}
 }
 
+func TestLoadAppliesObjectStorageEnvOverrides(t *testing.T) {
+	t.Setenv("OBJECT_STORAGE_BUCKET_ACL", "private")
+	t.Setenv("OBJECT_STORAGE_OBJECT_ACL", "public-read")
+	t.Setenv("OBJECT_STORAGE_SIGNED_URL_TTL", "45m")
+
+	configPath := writeTestConfig(t, `
+object_storage:
+  bucket_acl: public-read
+  object_acl: private
+  signed_url_ttl: 10m
+`)
+
+	cfg, err := Load(configPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.ObjectStorage.BucketACL != "private" {
+		t.Fatalf("expected env bucket acl, got %q", cfg.ObjectStorage.BucketACL)
+	}
+	if cfg.ObjectStorage.ObjectACL != "public-read" {
+		t.Fatalf("expected env object acl, got %q", cfg.ObjectStorage.ObjectACL)
+	}
+	if cfg.ObjectStorage.SignedURLTTL != 45*time.Minute {
+		t.Fatalf("expected env signed url ttl, got %s", cfg.ObjectStorage.SignedURLTTL)
+	}
+}
+
 func TestLoadAppliesBrandLibraryDefaults(t *testing.T) {
 	configPath := writeTestConfig(t, `
 brand_library: {}