fix(security): remove hardcoded Gitea token from xbctl binary

Token now read from credentials.env (GITEA_TOKEN key) at runtime,
with fallback to GITEA_TOKEN environment variable.

cmd/xbctl/main.go

@@ -31,7 +31,6 @@ const (
 	serviceFilePath        = "/etc/systemd/system/xboard-node.service"
 	defaultInstallRoot     = "/etc/xboard-node"
 	downloadBase           = "https://gitea.fp-will.xyz/will/xboard-node"
-	downloadToken          = "cf6634b57d2c60c66030dbb29d77c4ed25370e94"
 )
 
 var (
@@ -598,14 +597,28 @@ func resolveDownloadURL(artifact, version string) string {
 	return downloadBase + "/releases/download/" + version + "/" + artifact
 }
 
+// readDownloadToken returns the Gitea API token for downloading release assets.
+// Lookup order: GITEA_TOKEN in credentials.env, then GITEA_TOKEN env var.
+func readDownloadToken() string {
+	if data, err := os.ReadFile(defaultCredentialsPath); err == nil {
+		for _, line := range strings.Split(string(data), "\n") {
+			line = strings.TrimSpace(line)
+			if k, v, ok := strings.Cut(line, "="); ok && k == "GITEA_TOKEN" {
+				return v
+			}
+		}
+	}
+	return os.Getenv("GITEA_TOKEN")
+}
+
 func downloadFile(url, dest string) error {
 	client := &http.Client{Timeout: 120 * time.Second}
 	req, err := http.NewRequest("GET", url, nil)
 	if err != nil {
 		return err
 	}
-	if downloadToken != "" {
-		req.Header.Set("Authorization", "token "+downloadToken)
+	if tok := readDownloadToken(); tok != "" {
+		req.Header.Set("Authorization", "token "+tok)
 	}
 	resp, err := client.Do(req)
 	if err != nil {