ci: publish client builds to a downloads page under player-facing names

Each run now stages what it built as DorkNet-<release>-PC-Full.zip,
-PC-Patch.zip, -Quest.xapk and -Quest-Installer.zip, writes their sizes and
SHA-256 to a manifest, and uploads them with a static page to an S3 bucket
served read-only (ci/downloads). The build scripts keep their own names,
which the launcher depends on; only the published copies are renamed.

PUBLISH_DOWNLOADS (on by default) turns the upload off per run. Jenkins
archives the same renamed files instead of the raw build output.

ci/jenkins/README.md

@@ -11,14 +11,24 @@ The builds run on a **build agent**, not on Jenkins itself:
   job runs on it through the `dorknet-builder` label.
 - **Jenkins itself:** stays on the stock image and runs no builds.
 
-| Platform | Output (Jenkins artifacts) | How |
-|---|---|---|
-| PC | `out/pc/dorknet-clientpatch-march_2023_03_21.zip`: MelonLoader, mod, config template, Steam stub, `manifest.json`; no game files | `tools/build_pc.py patcher` |
-| PC | `out/pc/dorknet-client-march_2023_03_21.zip`: the stock Steam build with the patcher applied and your config; ready to run | `tools/build_pc.py client` |
-| Quest | `out/quest/dorknet-recroom-<code>.apk` and `out/quest/DorkNet-Quest-<ver>/` (`.xapk` + installers) | `DorkNet.Quest/scripts/build.py build` |
+Each build is published to the **downloads page** under a name players can
+read, and the same files are kept as Jenkins artifacts
+(`out/downloads/2023.03/`):
 
-The full PC client and the Quest packages contain game files, so keep them on
-Jenkins. Don't publish them anywhere public.
+| Download | What it is | Built from |
+|---|---|---|
+| `DorkNet-2023.03-PC-Full.zip` | the stock Steam build with the patcher applied and your config; ready to run | `tools/build_pc.py client` → `dorknet-client-march_2023_03_21.zip` |
+| `DorkNet-2023.03-PC-Patch.zip` | MelonLoader, mod, config template, Steam stub, `manifest.json`; no game files | `tools/build_pc.py patcher` → `dorknet-clientpatch-march_2023_03_21.zip` |
+| `DorkNet-2023.03-Quest.xapk` | patched APK + OBB, for the browser installer or SideQuest | `DorkNet.Quest/scripts/build.py build` → `DorkNet-Quest-<ver>/DorkNet-<ver>.xapk` |
+| `DorkNet-2023.03-Quest-Installer.zip` | `install.cmd` / `install.ps1` / `install.sh` + README, unzipped next to the `.xapk` | the same package folder |
+
+The build scripts keep their own names: the launcher downloads
+`dorknet-clientpatch-<VersionKey>.zip` from GitHub Releases by that exact
+name. `ci/downloads/publish.py` renames only the published copies.
+
+The full PC client and the Quest packages contain game files. The downloads
+page is behind Cloudflare Access for that reason; don't publish them
+anywhere public.
 
 ## Where the stock builds come from
 
@@ -54,7 +64,11 @@ Resolve a table for another build locally with `build.py build --dump-cs`.
   - `Jenkinsfile` and `ci/jenkins/` rebuild both.
 - **Build with Parameters** runs a manual build:
   - `PLATFORMS` (both / pc / quest), and `PC_FULL_CLIENT` for the full PC client;
-  - snapshot tags, and per-run repository overrides.
+  - snapshot tags, and per-run repository overrides;
+  - `PUBLISH_DOWNLOADS` (on by default) to publish to the downloads page.
+
+Push builds publish too, but only the platform they rebuilt: the page keeps
+the other platform's last files.
 
 ## Setup
 
@@ -124,6 +138,9 @@ Save, open the node, and copy its **secret**.
    | `ARCHIVE_PC_REPO` | Steam repository folder on the FTP, e.g. `Rec Room Versions/steam-v2` (plain text, not URL-encoded) |
    | `ARCHIVE_QUEST_REPO` | Quest repository folder, e.g. `Rec Room Versions/quest-v2` |
    | `ARCHIVE_FTP_TLS` | `explicit` (default), `implicit` or `none` |
+   | `DOWNLOADS_S3_ENDPOINT` | the downloads bucket's S3 API, internal address, e.g. `http://garage-<service uuid>:3900` |
+   | `DOWNLOADS_BUCKET` | its name, e.g. `downloads.example.com` |
+   | `DORKNET_SITE_URL` | optional: the DorkNet server's website (e.g. `https://dorknet.example.com`); the page links its Quest installer |
 
 3. **Deploy.** The first image build downloads the Android NDK (~1.5 GB) and
    takes a while. The node shows as connected in Jenkins once the agent is up.
@@ -159,6 +176,7 @@ Add these under **Manage Jenkins → Credentials**, with exactly these IDs:
 | `quest-keystore-password` | Secret text | its store/key password |
 | `clientmod-config` | Secret file | your `dorknet-clientmod.json` |
 | `quest-config` | Secret file | your `dorknet-quest.cfg` |
+| `downloads-s3` | Username with password | S3 key for the downloads bucket: access key ID / secret. Give it read and write on that bucket only. |
 
 **Use the keystore your players' installs were signed with**, the
 `dorknet-debug.keystore` from your earlier local builds (password `dorknet`). A
@@ -184,6 +202,50 @@ In the repository's **Settings → Webhooks**:
 - Content type: `application/json`
 - Events: just the push event
 
+### 8. The downloads page
+
+The page (`ci/downloads/index.html`) is a static file in an S3 bucket. It
+renders the bucket's `manifest.json`, which `publish.py upload` rewrites after
+each build. With Garage (the S3 store on the Coolify server):
+
+1. **Bucket and key.** Create the bucket, serve it as a website, and give
+   Jenkins a key for that bucket only:
+
+   ```sh
+   garage bucket create downloads.example.com
+   garage bucket website --allow downloads.example.com
+   garage key create jenkins-downloads
+   garage bucket allow --read --write --key <key id> downloads.example.com
+   ```
+
+   Store the key as the `downloads-s3` credential. Garage's web endpoint (port
+   `3902`) serves a bucket whose name is the request's host name, read-only.
+2. **Route.** Point the hostname at the web endpoint with a Coolify dynamic
+   proxy configuration (**Servers → Proxy → Dynamic Configurations**):
+
+   ```yaml
+   http:
+     routers:
+       downloads:
+         entryPoints: [http]
+         service: downloads
+         rule: Host(`downloads.example.com`)
+     services:
+       downloads:
+         loadBalancer:
+           passHostHeader: true
+           servers:
+             - url: "http://garage-<service uuid>:3902"
+   ```
+
+3. **Access.** Put the hostname behind a Cloudflare Access application
+   **before** the first publish, with the policies of the people who may
+   download. That group needs no other application.
+
+Files are uploaded with `Cache-Control: no-cache`, so Cloudflare never serves
+an old build after a new one replaces it. Each release keeps one copy of each
+file; a new build overwrites it.
+
 ### Disk
 
 The agent's `dorknet_cache` volume holds the restored stock builds, several GB