feat(site): Downloads page and Quest install from the latest build

When the server is pointed at the bucket CI publishes builds to
(DorkNet:Downloads:BaseUrl), the site lists them on a new Downloads page and
the Quest page offers "Latest build" next to "Choose file".

The server reads manifest.json and the files over HTTP on the internal network
and streams them through with Range support (DownloadsController); only files
the manifest lists are served. The xapk reader now reads from a byte source,
either the picked File or the server URL via Range requests, so the browser
installer streams the APK and OBB to the headset without downloading the
package first. Unset, both features stay hidden.

DorkNet.Server/Startup/RequestTracingExtensions.cs

@@ -238,6 +238,9 @@ public static class RequestTracingExtensions
             return false;
 
         var path = request.Path.Value ?? "";
+        // Client builds are streamed through (several GB): never buffer them.
+        if (path.StartsWith("/api/site/v1/downloads/files/", StringComparison.OrdinalIgnoreCase))
+            return false;
         var ext = Path.GetExtension(path);
         if (string.IsNullOrEmpty(ext))
             return true;

DorkNet.Server/Startup/ServiceCollectionExtensions.cs

@@ -217,6 +217,12 @@ public static class ServiceCollectionExtensions
         // so a deployment with no GitHub credentials behaves normally.
         services.AddSingleton<IGitHubIssues, GitHubIssueService>();
         services.AddHostedService<TestCaseIssueReconciler>();
+        // CI-published client builds for the site's Downloads / Quest pages.
+        // Off (IsConfigured=false) without DorkNet:Downloads:BaseUrl. No client
+        // timeout: a multi-GB file streams for longer than the default 100 s;
+        // the request's own abort token still ends it.
+        services.AddHttpClient(DownloadsService.HttpClientName, c => c.Timeout = Timeout.InfiniteTimeSpan);
+        services.AddSingleton<DownloadsService>();
         // Scoped (per-request) — these services hold DbContext references and
         // must share the request's scope to participate in the request's
         // transaction lifecycle. Pre-PR-3 they were Singleton with in-process