Default the update repo to the Gitea host

Settles the first open question in claude.md: the update endpoint is
gitea.apointless.space/bsncubed/ipswap. It was left empty — which disables the
checker — only because the host was unconfirmed.

Load unmarshals over the defaults, so an absent update_repo takes the new
default while an explicitly empty one stays empty. That distinction is the off
switch, and forks depend on it, so it is now pinned by a test.

Adds the config package's first tests while here: the defaulting rules above,
the repair path for a nonsensical mask style or poll interval, and the
guarantee that a corrupt config.json still yields usable defaults rather than
stopping the app from starting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -106,10 +106,14 @@ localised and parsing it breaks on a non-English Windows.
 
 ## Updates
 
-Set an update repository in Settings (`https://host/owner/repo`) and ipswap
-checks its Gitea releases API at startup, in a goroutine, behind a short
-timeout, failing silently to the log — a laptop on a customer site usually
-cannot reach the host, and that is not an error worth showing.
+ipswap checks `https://gitea.apointless.space/bsncubed/ipswap` by default. The
+check runs at startup in a goroutine, behind a short timeout, and fails
+silently to the log — a laptop on a customer site usually cannot reach the
+host, and that is not an error worth showing.
+
+Point it elsewhere, or clear it to switch the check off entirely, in Settings
+(`update_repo` in `config.json`). Forks should change it: otherwise they will
+offer their users an upstream binary.
 
 A newer tag adds "Update available — vX.Y.Z" to the top of the tray menu.
 Clicking it downloads the `.exe`, verifies its SHA256 against the release, and