refactor: Use environment variables for upload script authentication

- Add FORGEJO_TOKEN environment variable support to both upload scripts
- Windows: Add Credential Manager storage via -SaveToken flag
- macOS: Add config file storage via --save-token flag
- Scripts now check: parameter -> env var -> credential manager/config
- Update FORGEJO_PACKAGES_SETUP.md with all authentication methods
- Token is now optional - scripts find it automatically
- Matches git authentication workflow

FORGEJO_PACKAGES_SETUP.md

@@ -24,11 +24,38 @@ Create a token with package write permissions:
 3. Name: `BUILD_UPLOAD_TOKEN`
 4. Scopes: Check `write:package`, `api`
 5. Click "Generate Token"
-6. Copy the token (you'll use it for uploads)
+6. Copy the token
 
-**Store securely** - this token grants upload access!
+### 2. Store Token Securely
 
-### 2. Build Scripts
+Choose one of these methods:
+
+**Option A: Environment Variable (Simplest)**
+```powershell
+# Windows PowerShell
+$env:FORGEJO_TOKEN = "your_token_here"
+```
+
+**Option B: Credential Manager (Windows - Most Secure)**
+```powershell
+.\build\scripts\upload_to_packages.ps1 -SaveToken -ForgejoToken "your_token_here"
+# Token is encrypted and stored for future use
+```
+
+**Option C: Config File**
+```bash
+# macOS/Linux - Save to home directory
+bash build/scripts/upload_to_packages.sh --save-token -t "your_token_here"
+# Saved to ~/.config/webdrop-bridge/.env (chmod 600)
+```
+
+**Option D: Project .env (Development Only)**
+Create `.env` in project root and add to `.gitignore`:
+```
+FORGEJO_TOKEN=your_token_here
+```
+
+### 3. Build Scripts
 
 Upload scripts are already created:
 - Windows: `build/scripts/upload_to_packages.ps1`
@@ -56,18 +83,24 @@ bash build/scripts/build_macos.sh
 
 ### Step 2: Upload to Packages
 
+After storing your token (see Setup Requirements above), uploading is simple:
+
 **Windows Upload:**
 ```powershell
-$token = "your_token_from_settings"
-.\build\scripts\upload_to_packages.ps1 -Version 1.0.0 -ForgejoToken $token
+.\build\scripts\upload_to_packages.ps1 -Version 1.0.0
 ```
 
 **macOS Upload:**
 ```bash
-token="your_token_from_settings"
-bash build/scripts/upload_to_packages.sh -v 1.0.0 -t $token
+bash build/scripts/upload_to_packages.sh -v 1.0.0
 ```
 
+The scripts will automatically find your token from:
+1. `-ForgejoToken` / `-t` parameter (if provided)
+2. `$env:FORGEJO_TOKEN` / `$FORGEJO_TOKEN` environment variable
+3. Windows Credential Manager / `~/.config/webdrop-bridge/.env`
+4. Project `.env` file
+
 ### Step 3: Tag and Commit
 
 Once both are uploaded:
@@ -158,41 +191,75 @@ async def check_for_updates(self) -> Optional[UpdateInfo]:
 
 ### Windows Script (`upload_to_packages.ps1`)
 
+**Basic Usage:**
 ```powershell
-Usage: .\upload_to_packages.ps1 -Version 1.0.0 -ForgejoToken $token
-
-Parameters:
-  -Version          Version number (required, e.g., "1.0.0")
-  -ForgejoToken     Personal access token (required)
-  -ForgejoUrl       Forgejo server URL (default: https://git.him-tools.de)
-  -Repo             Repository (default: HIM-public/webdrop-bridge)
-  -ExePath          Path to exe file (default: build\dist\windows\WebDropBridge.exe)
-  -ChecksumPath     Path to checksum file
-
-What it does:
-  1. Verifies exe and checksum files exist
-  2. Uploads exe to Packages
-  3. Uploads checksum to Packages
-  4. Shows success/error messages
+# After storing token (see Setup Requirements)
+.\build\scripts\upload_to_packages.ps1 -Version 1.0.0
 ```
 
+**First time setup - Save token to Credential Manager:**
+```powershell
+.\build\scripts\upload_to_packages.ps1 -SaveToken -ForgejoToken "your_token"
+# Then future uploads just need version
+.\build\scripts\upload_to_packages.ps1 -Version 1.0.0
+```
+
+**Parameters:**
+- `-Version` - Version number (required, e.g., "1.0.0")
+- `-ForgejoToken` - Personal access token (optional if stored)
+- `-SaveToken` - Save token to Credential Manager
+- `-ForgejoUrl` - Forgejo server URL (default: https://git.him-tools.de)
+- `-Repo` - Repository (default: HIM-public/webdrop-bridge)
+- `-ExePath` - Path to exe file (default: build\dist\windows\WebDropBridge.exe)
+- `-ChecksumPath` - Path to checksum file
+
+**Script flow:**
+1. Check for token in: parameter → environment → Credential Manager
+2. Verify exe and checksum files exist
+3. Upload exe to Packages API
+4. Upload checksum to Packages API
+5. Show success message with package URL
+
 ### macOS Script (`upload_to_packages.sh`)
 
+**Basic Usage:**
 ```bash
-Usage: ./upload_to_packages.sh -v 1.0.0 -t $token
-
-Options:
-  -v, --version     Version number (required)
-  -t, --token       Personal access token (required)
-  -u, --url         Forgejo server URL (default: https://git.him-tools.de)
-
-What it does:
-  1. Verifies dmg and checksum files exist
-  2. Uploads dmg to Packages
-  3. Uploads checksum to Packages
-  4. Shows success/error messages
+# After storing token (see Setup Requirements)
+bash build/scripts/upload_to_packages.sh -v 1.0.0
 ```
 
+**First time setup - Save token to config:**
+```bash
+bash build/scripts/upload_to_packages.sh --save-token -t "your_token"
+# Then future uploads just need version
+bash build/scripts/upload_to_packages.sh -v 1.0.0
+```
+
+**Options:**
+- `-v, --version` - Version number (required, e.g., "1.0.0")
+- `-t, --token` - Personal access token (optional if stored)
+- `--save-token` - Save token to ~/.config/webdrop-bridge/.env
+- `-u, --url` - Forgejo server URL (default: https://git.him-tools.de)
+
+**Script flow:**
+1. Check for token in: parameter → environment → ~/.config/webdrop-bridge/.env → project .env
+2. Verify dmg and checksum files exist
+3. Upload dmg to Packages API
+4. Upload checksum to Packages API
+5. Show success message with package URL
+
+### Token Resolution Order
+
+Both scripts check for tokens in this priority:
+1. **Parameter**: `-ForgejoToken "token"` (PowerShell) or `-t "token"` (Bash)
+2. **Environment**: `$env:FORGEJO_TOKEN` (PowerShell) or `$FORGEJO_TOKEN` (Bash)
+3. **Stored Config**:
+   - Windows: Credential Manager (via `-SaveToken` flag)
+   - macOS/Linux: `~/.config/webdrop-bridge/.env`
+4. **Project File**: `.env` in project root (if exists)
+
+This design matches how git handles credentials!
+
 ## Complete Release Checklist
 
 ```