feat: add signed PostgreSQL release updates

oa-backend/src/main/java/com/kaidi/oa/web/SystemUpdateController.java

@@ -0,0 +1,42 @@
+package com.kaidi.oa.web;
+
+import com.kaidi.oa.common.ApiResp;
+import com.kaidi.oa.service.SystemUpdateService;
+import com.kaidi.oa.service.SystemUpdateService.UpdateStatus;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotBlank;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/** Administrator-only API for checking and installing signed Gitea releases. */
+@RestController
+@RequestMapping("/api/oa/system-update")
+public class SystemUpdateController {
+
+    private final SystemUpdateService updateService;
+
+    public SystemUpdateController(SystemUpdateService updateService) {
+        this.updateService = updateService;
+    }
+
+    @GetMapping("/status")
+    public ApiResp<UpdateStatus> status() {
+        return ApiResp.ok(updateService.status());
+    }
+
+    @PostMapping("/check")
+    public ApiResp<UpdateStatus> check() {
+        return ApiResp.ok(updateService.check());
+    }
+
+    @PostMapping("/install")
+    public ApiResp<UpdateStatus> install(@Valid @RequestBody InstallRequest request) {
+        return ApiResp.ok(updateService.install(request.version()));
+    }
+
+    public record InstallRequest(@NotBlank String version) {
+    }
+}