fix(ci): follow HTTP redirect and validate JSON in fetch-releases step

curl -sf without -L silently wrote '301 Moved Permanently' to releases.json
instead of following the http→https redirect. Added -L to follow redirects,
set -euo pipefail, and jq type validation so the step fails hard on bad JSON.

.gitea/workflows/release.yaml

@@ -192,11 +192,14 @@ jobs:
 
       - name: Fetch releases from Gitea API
         run: |
-          curl -sf \
+          set -euo pipefail
+          RESPONSE=$(curl -sfL \
             -H "Accept: application/json" \
-            "http://gitea.kalekber.cc/api/v1/repos/kamil/libnovel/releases?limit=50&page=1" \
-            -o ui/static/releases.json
-          echo "Fetched $(jq length ui/static/releases.json) releases"
+            "http://gitea.kalekber.cc/api/v1/repos/kamil/libnovel/releases?limit=50&page=1")
+          # Validate JSON before writing — fails hard if response is not a JSON array
+          COUNT=$(echo "$RESPONSE" | jq 'if type == "array" then length else error("expected array, got \(type)") end')
+          echo "$RESPONSE" > ui/static/releases.json
+          echo "Fetched $COUNT releases"
 
       - uses: docker/setup-buildx-action@v3