Refactor NodeCG runtime preparation and update handling

- Updated paths and configurations in doctor.mjs and prepare-nodecg-runtime.mjs to use new build-config.mjs imports.
- Enhanced runtime installation checks and permissions validation.
- Introduced new update configuration management in update-config.ts, including loading and validating update settings.
- Implemented update service for managing update checks and downloads in update-service.ts.
- Replaced update-utils.ts with update-schema.ts for better structure and clarity in update handling.
- Added comprehensive tests for update download and settings management.
- Ensured secure handling of download URLs and improved error handling in update processes.

src/tests/update-settings.test.ts

@@ -5,7 +5,7 @@ import path from "node:path";
 import test from "node:test";
 
 import { AppRuntimeConfig } from "../main/config/runtime-config";
-import { loadUpdateSettings, readUpdateFileConfig } from "../main/updates/update-settings";
+import { loadUpdateSettings, readUpdateFileConfig } from "../main/updates/update-config";
 
 const baseConfig: AppRuntimeConfig = {
   title: "Scoreko",
@@ -34,6 +34,18 @@ test("loadUpdateSettings keeps updates disabled when the runtime config disables
   assert.equal(settings.apiUrl, "https://gitea.local/releases/latest");
 });
 
+test("loadUpdateSettings fails closed on insecure production update URLs", () => {
+  const rootPath = makeTempRoot({
+    enabled: true,
+    apiUrl: "http://gitea.local/releases/latest",
+  });
+
+  const settings = loadUpdateSettings(baseConfig, rootPath, () => undefined, { allowInsecureHttp: false });
+
+  assert.equal(settings.enabled, false);
+  assert.equal(settings.apiUrl, undefined);
+});
+
 test("loadUpdateSettings lets runtime config override file settings", () => {
   const rootPath = makeTempRoot({
     enabled: true,