feat: add signed PostgreSQL release updates

oa-backend/src/main/resources/application.yml

@@ -10,17 +10,17 @@ spring:
       max-file-size: 50MB
       max-request-size: 60MB
   # ---------------------------------------------------------------------------
-  # Active datasource: SQLite (file-based, zero-setup). The MySQL and Postgres
-  # profiles are provided as stubs (application-mysql.yml / application-postgres.yml)
-  # so switching databases later is config-only: run with
-  #   --spring.profiles.active=mysql   (or postgres)
-  # and supply the JDBC url/credentials there. No Java code changes required.
+  # Local development defaults to SQLite. Production must activate the postgres
+  # profile and provide OA_DB_URL/OA_DB_USERNAME/OA_DB_PASSWORD.
   # ---------------------------------------------------------------------------
   datasource:
     url: jdbc:sqlite:./data/oa.db
     driver-class-name: org.sqlite.JDBC
     username:
     password:
+    hikari:
+      maximum-pool-size: 2
+      minimum-idle: 1
   jpa:
     hibernate:
       ddl-auto: update
@@ -35,6 +35,10 @@ spring:
           # 逐表读取列元数据，避免 SQLite 在表数量较多时报
           # "too many terms in compound SELECT"（启动期 schema 校验崩溃）。
           jdbc_metadata_extraction_strategy: individually
+  flyway:
+    # SQLite remains a zero-setup local development option only. Production
+    # migrations are enabled by application-postgres.yml.
+    enabled: false
 
 # CORS origins allowed for /api/** are configured in WebConfig (CorsConfig).
 # Allowed: http://localhost:8080, http://localhost:5173, http://127.0.0.1:*
@@ -53,3 +57,12 @@ oa:
   ai:
     api-key: ""
     model: claude-haiku-4-5-20251001
+  update:
+    enabled: ${OA_UPDATE_ENABLED:false}
+    gitea-base-url: ${OA_UPDATE_GITEA_BASE_URL:}
+    repository: ${OA_UPDATE_REPOSITORY:awaioi/ERP}
+    channel: ${OA_UPDATE_CHANNEL:stable}
+    token: ${OA_UPDATE_TOKEN:}
+    helper-command: ${OA_UPDATE_HELPER_COMMAND:}
+    state-file: ${OA_UPDATE_STATE_FILE:./runtime/update-state.json}
+    allow-insecure-http: ${OA_UPDATE_ALLOW_INSECURE_HTTP:false}