feat: implement app upgrade screen from the entry point of the app

[ahmed-tarek-salem]

App Update Feature

Overview

Checks if a newer app version is available and prompts the user to update. Supports:

• Force updates: user must update
• Flexible updates: user can dismiss or skip

How It Works

• On app launch, AppUpdateStore.checkForUpdate() is called
• It fetches version info from the API and loads any ignored version from local storage
• Before navigating, the router checks shouldShowUpdateScreen
• If an update is required, the user is redirected to /update

Update Options

Depending on the update type and API flags, the user may see:

• Update: Opens App Store / Play Store
• Later: Dismisses for the current session only
• Skip this version: Permanently ignores this specific version

Update Screen Behavior

Update Type	Later	Skip	User Options
Force	❌	❌	Update only
Flexible	✅	❌	Update, Later
Flexible	❌	✅	Update, Skip
Flexible	✅	✅	Update, Later, Skip

API

Endpoint: GET /wallet-app/version-check.json

Response example:

{
  "version": "2.5.0",
  "release_notes": "- Bug fixes\n- Performance improvements",
  "show_later_button": true,
  "show_ignore_button": false,
  "platforms": ["android", "ios"],
  "update_urls": {
    "ios": "https://apps.apple.com/app/qubic-wallet/id6502265811",
    "android": "https://play.google.com/store/apps/details?id=org.qubic.wallet"
  }
}

Key Fields

• version (required): Minimum required app version
• release_notes: What’s new (supports line breaks)
• show_later_button: Allows dismissing for session
• show_ignore_button: Allows skipping this version permanently
• platforms: Platforms the update applies to
• update_urls: Store links per platform

User Dismissal Behavior

• Later: Session-only, shown again on next launch
• Skip this version: Stored permanently; newer versions will still prompt

Edge Cases

• API failure or empty response → app continues normally
• Platform not applicable → no update screen
• Current version already valid → no update
• Invalid version string → defaults to 0.0.0

[sallymoc]

@ahmed-tarek-salem The App Store and Play Store URLs are constant — they're fully determined by our fixed bundle ID / package name (org.qubic.wallet), so we can build them in the app instead of reading them from the remote JSON. Letting the remote payload supply the URL means anyone who can write to (or MITM) static.qubic.org can serve a forced update (show_later_button: false + show_ignore_button: false) that routes every user — on a screen they can't dismiss — to an attacker-controlled APK or seed-entry phishing page.

[sallymoc]

@ahmed-tarek-salem 10 new keys added only to app_en.arb. Missing from app_de/es/fr/ru/tr/vi/zh.arb. Non-English users get fallback English on a forced upgrade gate.

[sallymoc]

@ahmed-tarek-salem
Redundant dependency: pub_semver: ^2.1.5 is already declared two lines below and is the Dart team's official semver package — it exposes the same Version.parse, Version(0,0,0), and comparison operators that app_update_store.dart uses. We're already consuming pub_semver in wallet_content_store.dart. Drop version: ^3.0.0 and switch the import in app_update_store.dart to package:pub_semver/pub_semver.dart.