Updates from Gitea, step 2: the connection (check and list work on the device)

The roots (ISRG X1 and X2), an HTTPS client that reads the answer as a
stream, GiteaReleases (the latest and a list of ten), the Update
Service's requests, install from Gitea through the existing install path,
the daily check's schedule, the Check for updates setting, and console
commands: update check | list | status | install <tag>.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/platform/https_get.h

@@ -0,0 +1,47 @@
+#pragma once
+
+#include <NetworkClientSecure.h>
+
+#include <memory>
+#include <string>
+
+#include "http_head.h"
+#include "platform/counted_client.h"
+
+namespace roro {
+
+// One HTTPS GET, read as a stream: the connection checks the server's chain and name against the
+// roots in ca_roots.h, the head is parsed, and the body comes out whole whether the server sent it
+// with a length or in chunks. Used by the Update Service to read Gitea's answers and to download a
+// release. Redirects aren't followed: the device only goes where it was told to (Q163).
+class HttpsGet {
+   public:
+    explicit HttpsGet(net::User user) : tls_(user) {}
+    ~HttpsGet() { close(); }
+
+    // Connects and reads the head. "" when a 200 is on its way, or why not, in words for the screen.
+    std::string open(const std::string& host, const std::string& path, const char* accept);
+    long contentLength() const { return head_.contentLength; }  // -1: not known
+
+    // Body bytes into `buf`: how many, 0 at the end, -1 when the connection broke or stalled
+    // before the end.
+    int read(uint8_t* buf, size_t len);
+    void close();
+
+   private:
+    static constexpr size_t kRaw = 1024;
+    static constexpr uint32_t kStallMs = 10000;
+
+    int readRaw(uint8_t* into, size_t len);  // from the connection, waiting up to kStallMs
+
+    Counted<NetworkClientSecure> tls_;
+    release::HttpHead head_;
+    release::ChunkedDecoder chunks_;
+    std::unique_ptr<uint8_t[]> raw_;
+    std::string early_;  // body bytes that arrived with the head
+    size_t earlyAt_ = 0;
+    long left_ = -1;  // body bytes still to come, if the server said how many
+    bool done_ = false;
+};
+
+}  // namespace roro