feat(desktop): add client release updater

server/internal/shared/swagger/descriptions.go

@@ -30,12 +30,17 @@ var routeDocs = map[string]routeDoc{
 	"GET /api/public/assets/:token": {"对外访问签名资源", "通过签名 token 直接访问对象存储中的图片/附件，无需登录。"},
 
 	// --- Desktop 客户端：注册 / 心跳 / 鉴权 ---
-	"POST /api/desktop/clients/register":  {"桌面客户端注册", "由租户用户登录后调用，为本机桌面客户端申请客户端凭证。"},
-	"POST /api/desktop/clients/rotate":    {"轮换客户端密钥", "客户端使用旧凭证调用，换取新的客户端密钥。"},
-	"POST /api/desktop/clients/heartbeat": {"客户端心跳上报", "桌面客户端定时上报存活与版本，服务端用于在线状态展示。"},
-	"POST /api/desktop/clients/offline":   {"客户端主动离线", "桌面客户端退出/休眠时上报，立即将本机标记为离线。"},
-	"POST /api/desktop/clients/revoke":    {"吊销客户端", "由桌面端调用，立即注销当前客户端凭证。"},
-
+	"GET /api/desktop/releases/latest":                                          {"查询最新客户端版本", "桌面客户端未登录时查询最新版本配置，不提前生成签名下载地址。"},
+	"GET /api/desktop/releases/download-url":                                    {"解析客户端下载地址", "用户开始下载时按最新版本配置即时生成下载地址，私有 OSS 会返回签名 URL。"},
+	"GET /api/desktop/releases/updater/:platform/:arch/:channel/:version":       {"自动更新 Feed", "桌面客户端开始自动更新时读取 Electron updater feed，私有 OSS 会在 feed 中写入短时签名下载地址。"},
+	"GET /api/desktop/releases/updater/:platform/:arch/:channel/:version/:feed": {"自动更新 Feed 文件", "兼容 Electron updater 对 latest*.yml 的二次请求，返回动态生成的 updater YAML。"},
+	"POST /api/desktop/clients/register":                                        {"桌面客户端注册", "由租户用户登录后调用，为本机桌面客户端申请客户端凭证。"},
+	"POST /api/desktop/clients/rotate":                                          {"轮换客户端密钥", "客户端使用旧凭证调用，换取新的客户端密钥。"},
+	"POST /api/desktop/clients/heartbeat":                                       {"客户端心跳上报", "桌面客户端定时上报存活与版本，服务端用于在线状态展示。"},
+	"POST /api/desktop/clients/offline":                                         {"客户端主动离线", "桌面客户端退出/休眠时上报，立即将本机标记为离线。"},
+	"POST /api/desktop/clients/revoke":                                          {"吊销客户端", "由桌面端调用，立即注销当前客户端凭证。"},
+	"GET /api/desktop/clients/releases/latest":                                  {"查询最新客户端版本（桌面鉴权）", "桌面客户端带 client token 查询最新版本，默认沿用本机注册渠道。"},
+	"GET /api/desktop/clients/releases/download-url":                            {"解析客户端下载地址（桌面鉴权）", "桌面客户端开始更新下载时即时获取下载地址，私有 OSS 会返回签名 URL。"},
 	// --- Desktop：派单与拉取 ---
 	"GET /api/desktop/dispatch":                 {"派单 WebSocket", "桌面客户端通过 WebSocket 长连接订阅派单事件，断线后自动重连。"},
 	"GET /api/desktop/accounts":                 {"拉取账号列表（桌面）", "桌面客户端拉取本机绑定/可用的媒体账号，支持增量同步。"},

server/internal/shared/swagger/swagger.go

@@ -500,6 +500,10 @@ func errorResponse(description string) map[string]any {
 func securityForPath(path string) []map[string][]string {
 	if path == "/api/auth/password-key" ||
 		path == "/api/auth/login" || path == "/api/auth/refresh" ||
+		path == "/api/desktop/releases/latest" ||
+		path == "/api/desktop/releases/download-url" ||
+		path == "/api/desktop/releases/updater/:platform/:arch/:channel/:version" ||
+		path == "/api/desktop/releases/updater/:platform/:arch/:channel/:version/:feed" ||
 		strings.HasPrefix(path, "/api/health/") ||
 		strings.HasPrefix(path, "/api/public/") {
 		return nil