Fix publish_release.sh to upload installer + AppImage; document host REQUIRE_SIGNIN_VIEW

- Script uploaded only the three portable binaries; v0.2.1 release was
  missing step-line-setup-0.2.1.exe and the AppImage. Now uploads the full
  set (extras when present), reuses existing releases (adds missing assets),
  and falls back to ~/.git-credentials basic auth when GITEA_TOKEN is unset
- Back-filled both missing assets onto the live v0.2.1 release via API
  (release now carries all 5 artifacts)
- TODO/RELEASING/MEMORY document the findings and the host admin steps for
  anonymous downloads ([service] REQUIRE_SIGNIN_VIEW)

TODO.md

@@ -1,11 +1,20 @@
 # TODO
 
-## Distribution follow-up (host config, no code work)
+## Distribution follow-up (findings + host config)
 
-- [ ] The host now requires sign-in broadly: `/releases/download/…` AND the `v0.2.1` tag page
-      redirect to login (the `v0.2.0` tag page was public earlier — host config changed). Decide
-      with the host admin: open repo visibility / `REQUIRE_SIGNIN_VIEW=false`, or accept that
-      anonymous users must sign in to browse/download. Repo/CI side is complete.
+Verified via API+host credentials (2026-10-31):
+
+- [x] Repo is **public** (`private:false`) and account has admin rights.
+- [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
+      AppImage) — the two installers were missing after CI publish (script uploaded only the
+      portables); `tools/publish_release.sh` fixed to include them and re-uploaded via API.
+- [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
+      anonymous browsing/downloads redirect to login (API-confirmed repo is public; this is a
+      server `app.ini` setting, not an API or repo option).
+      Advised path for the host admin: set `REQUIRE_SIGNIN_VIEW = false` in `app.ini` under
+      `[service]`, restart Gitea, then verify `curl -sI https://git.allucanget.biz/zwitschi/security-game/releases/tag/v0.2.1`
+      returns 200 (not a login redirect) and an anonymous asset download succeeds. Alternative:
+      mirror downloads (Itch.io / GitHub Releases) for anonymous users.
 
 ## Future Systems (design-level backlog)
 
@@ -25,3 +34,11 @@ performance hardening only.
 - [ ] Profile the crowd: ensure textured materials and props hold target frame rate around a
       busy entrance.
 - [ ] Add LOD or culling for distant NPCs/props if the crowd grows.
+
+## Generalized Game Asset Tooling
+
+- [ ] Reuse the OpenRouter image backend for role-aware arbitrary asset generation.
+- [ ] Add exact-dimension image crop and aspect-preserving resize commands.
+- [ ] Audit existing assets for role-specific dimensions, aspect, alpha, and tile seams;
+      report projection/perspective checks for visual review.
+- [ ] Add automated tests and document asset-pipeline usage.