feat(release): decouple distribution from the source repo

Publish every release to the public OwnCord-releases repo with a full
source snapshot (AGPL section 6 for binary recipients), and make the
updater's repo coordinates configurable (github.owner/github.repo),
defaulting to OwnCord-releases. Both the server self-update and the
/client-update chain follow the new default, so deployed servers keep
updating after the source repo goes private.

The publish step fails closed: a private source repo with no
RELEASES_REPO_TOKEN aborts the release instead of silently shipping
binaries with no public source or update feed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Server/config/config.go

@@ -79,8 +79,14 @@ type PluginsConfig struct {
 }
 
 // GitHubConfig holds GitHub API settings for update checking.
+//
+// Owner/Repo point at the public releases repository. Server and client
+// update checks fetch release assets from this repo, so it must stay
+// publicly readable even when the source repository is private.
 type GitHubConfig struct {
 	Token string `koanf:"token"`
+	Owner string `koanf:"owner"`
+	Repo  string `koanf:"repo"`
 }
 
 // VoiceConfig holds LiveKit server connection and voice quality settings.
@@ -188,7 +194,10 @@ func defaults() Config {
 			LiveKitURL: "ws://localhost:7880",
 			Quality:    "medium",
 		},
-		GitHub: GitHubConfig{},
+		GitHub: GitHubConfig{
+			Owner: "J3vb",
+			Repo:  "OwnCord-releases",
+		},
 		EventPersistence: EventPersistenceConfig{
 			Enabled:               true,
 			RetentionHours:        24,