feat(gui,core): opt-in check for new releases

Preferences gets a switch that asks GitHub once a day for the latest
release and shows a banner over the sidebar when it is newer. Off by
default. Packages whose package manager brings updates install the
marker share/proton-drive-linux/managed-updates, which hides the switch.

Refs #42

docs/CHANGELOG.md

@@ -15,6 +15,10 @@ scratch (user data in `staging/` and `recovery/` is never touched by this).
 - **A COPR repository for Fedora**, so `dnf upgrade` brings each new release:
   `sudo dnf copr enable narrrl/proton-drive-linux`. Every release also ships the vendored crates
   as `proton-drive-linux-vendor-<version>.tar.xz`, which the COPR build uses offline (#42).
+- **The app can tell you about a new release.** Turn on **Check for updates** in Preferences, and
+  the app asks GitHub once a day and shows a banner with a **Download** button when a newer
+  version is out. It is off by default, and not offered for packages that a package manager
+  updates (COPR, the AUR, Nix) (#42).
 
 ## [3.5.0] — 2026-10-16
 

docs/CONFIGURATION.md

@@ -61,6 +61,7 @@ fix it.
   "proton_theme": true,
   "online_map": false,
   "tray_hidden": false,
+  "update_check": false,
   "files_view": { "list": true, "sort": "modified", "descending": true, "folders_first": true },
   "window": { "width": 980, "height": 680, "maximized": false },
   "open_with": {
@@ -87,6 +88,9 @@ fix it.
 | `proton_theme` | bool | follow system | General → Appearance | Proton's colours instead of the system theme |
 | `online_map` | bool | `false` | General → Appearance | Street map for Places from OpenFreeMap |
 | `tray_hidden` | bool | `false` | General → Appearance | Hide the tray icon |
+| `update_check` | bool | `false` | General → Updates | Ask GitHub once a day for a newer release and show it over the sidebar. Not offered where a package manager installs updates |
+| `update_last_checked` | Unix seconds | none | — | Written by the update check, so a restart does not ask again within a day |
+| `update_latest` | version | none | — | The latest release the update check found |
 | `files_view` | object | grid, by name | My files view menu | `list`, `sort` (`name`, `size`, `modified`), `descending`, `folders_first` |
 | `window` | object | 980 × 680 | Resizing the app window | `width`, `height` (the unmaximized size), `maximized` |
 | `open_with` | object | `xdg-open` | — | See [`open_with`](#open_with) |

docs/INSTALL.md

@@ -288,6 +288,13 @@ starts; to switch at once:
 systemctl --user restart proton-drive.service
 ```
 
+With the `.deb`, the release `.rpm` or the `.tar.gz`, nothing tells you about a new release.
+Turn on **Preferences → General → Check for updates** and the app asks GitHub once a day and
+shows a banner over the sidebar when a newer version is out. Packages that a package manager
+updates do not offer the setting. A package shows this by installing the empty file
+`share/proton-drive-linux/managed-updates` under the prefix of its `bin/` directory, for example
+`/usr/share/proton-drive-linux/managed-updates`.
+
 Coming from 2.8.0 or older, re-enable the service once. Those releases hooked it into
 `default.target`, which starts it before the desktop session is ready; on KDE that crashes
 `ksecretd` at every login. Signing in again or toggling "Start on login" does this as well:

docs/SECURITY_MODEL.md

@@ -60,8 +60,12 @@ The client connects only to:
 - **Proton**, for the Drive and account API, and for the CAPTCHA page when Proton asks for one.
 - **OpenFreeMap**, for the street map of Places in Photos, only if you turn it on in Preferences. It is off by default, because the tile server learns which parts of the
   world you look at. The default map is drawn from data shipped with the app.
+- **GitHub**, once a day, to ask for the latest release, only if you turn on **Check for updates**
+  in Preferences. It is off by default, because GitHub learns your IP address and, from the user
+  agent, which version you run. Packages updated by a package manager (COPR, the AUR, Nix) do
+  not offer the setting and never ask.
 
-There is no telemetry, no analytics and no update check. The SDK can report timings of its own
+There is no telemetry and no analytics. The SDK can report timings of its own
 operations, and the client only writes them to its local log.
 
 ## What this client does not protect against