Signed central update service and separated release channels

Connected every installation to the isolated update service at updates.skymission.info.
Added Ed25519 verification for signed release metadata and local signing-key trust.
Added centrally assigned Stable, Beta, and Development channels that cannot be changed locally.
Added short-lived, single-use download URLs and strict package-host validation.
Separated production, development, and update-service host responsibilities.
Made the installer create missing config and storage directories automatically.
Added Sodium to the installation requirements for signed-update verification.
Retained manual ZIP updates as an administrator recovery path.

Changelog