Let a failed update check say so, instead of reporting good news

The phone reported every build as current because the release repository is
private. Gitea answers 404 rather than 403 for a repo you cannot see, the client
reads that address anonymously, and AndroidUpdateChannel caught the failure and
returned null — which IUpdateChannel documented as meaning "this build is the
latest". The check had never once succeeded on any phone and nothing anywhere
said so.

Two faults, and the second is why the first lasted.

The seam said null was the honest answer for an unreachable channel, on the
reasoning that the caller does the same thing either way. That is true of the
six-hourly pass and false of CHECK NOW. UpdateViewModel already draws the line
correctly — silent on the timer, the exception's message on the button — and it
could only ever draw the first half, because nothing was ever thrown at it. The
desktop's channel does not catch, so the interface described neither
implementation.

So CheckAsync throws now, and null means one thing. A release that is reachable
but missing its manifest or the APK it names throws too: "you are up to date"
about a half-published feed is the same lie in a smaller costume, and the
self-healing that argument protected is untouched, since the timer still swallows
everything.

The precondition is written down where somebody would look, rather than left as a
sentence about where a token could live. ADR 0013 §4 already said a private
release repository was incompatible with this design; nobody checked which side
of it this repository was on. It is one curl, and manual-checks phase 16 now
opens with it — pointedly not against /api/v1/version, which answers 200 from a
forge that is up whatever is readable on it, and which is what made this look
like nothing was wrong.

Phone check 17.4 was the one that passed all along. It now presses CHECK NOW with
the network off as well as on, because two different answers are the whole of
what makes the first one worth reading.

README.md

@@ -134,6 +134,19 @@ operator of a deployment is precisely the party the trust model is about. An ope
 get it. They are not where it comes from, and the update check inside the application points at the
 project's own forge and nowhere else. See [ADR 0011](docs/adr/0011-android-distribution.md) rule 2.
 
+**That address is read anonymously, so the repository behind it has to be public** — on both heads. There is
+no token and there is deliberately nowhere to put one: it would have to be readable before the vault is
+unlocked, and the only file readable then is the plaintext settings file, which is the one place a token may
+not go. If the repository is private, every check answers `404`, and the honest thing the client can do
+about that is say so. It is one line to check:
+
+```bash
+curl -so /dev/null -w '%{http_code}\n' https://git.dodotech.cloud/api/v1/repos/DodoTech/DodoSSH
+```
+
+`200` and updates work. `404` and they cannot. `/api/v1/version` answering `200` proves only that the forge
+is up, which is what made this look like nothing was wrong for as long as it did.
+
 **Uninstalling removes the application and leaves your vault cache** at `%LOCALAPPDATA%\DodoSSH`, so
 reinstalling asks for your passphrase rather than starting over. Use **Sign out** inside the application if
 you want the machine to genuinely forget everything — an uninstall is not a sign-out, and does not withdraw