Embed release public key; rename signing secret to RELEASE_SIGNING_KEY

SPEC.md

@@ -176,7 +176,7 @@ Docker.
   `dev` builds and builds without an embedded public key never update.
 - **Signing setup (one time)**: `openssl genpkey -algorithm ed25519 -out
   private.pem`; `openssl pkey -in private.pem -pubout -out public.pem`.
-  Private key → repo secret `SIGNING_KEY`; public key → committed into
+  Private key → repo secret `RELEASE_SIGNING_KEY`; public key → committed into
   `internal/update/pubkey.go`. CI signs release binaries with
   `openssl pkeyutl -sign -rawin`.
 
@@ -280,7 +280,7 @@ are new.
      `write:package` scope) because the automatic `GITEA_TOKEN` cannot push
      packages; the username is just `gitea.actor`.
   3. on a version tag: also build the Windows binary, sign it with OpenSSL
-     (`SIGNING_KEY` secret), and attach `gpu-turnstile.exe`, `.sig` and
+     (`RELEASE_SIGNING_KEY` secret), and attach `gpu-turnstile.exe`, `.sig` and
      `.sha256` to a Gitea release for the auto-updater.
 - Release: a git tag `vX.Y.Z` produces the versioned image and the signed
   Windows binary; the Open WebUI compose pins that tag. No images or