[PatrickSt1991]

Closes #30. Replaces #36, which GitHub closed when its base branch (#35, now merged) was deleted; rebased onto main.

Inderdeep29 asked to send a custom package to TV-Store from a browser, since with Host PC IP pointing at the TV the phone and PC can no longer install. This adds that, with the TV in charge of what gets installed.

How it works

1. A phone or PC opens http://<TV IP>:8077/upload (Settings on the TV shows it as a QR code): a small page, pick a .wgt or .tpk, Send to the TV, with a progress bar.
2. The service takes the file (PUT /upload?name=), streams it to its data folder while hashing it, and reads the package's own ids from config.xml or tizen-manifest.xml (new service/manifest.js, also used for the vd_appinstall app id). Anything that is not a Tizen package, is not .wgt/.tpk, or is over 400 MB is refused with a reason the page shows. One file waits at a time; a new one replaces it.
3. TV-Store on the TV polls /uploads every 3 s and opens a sheet: who sent it, the file, what it calls itself and its version, the hash, an Update from vX / Installed badge when the TV has that package, and a warning that the file is not from the catalog. Install on this TV runs the normal install and done screens (first step reads "Received from your phone or PC"); Not now keeps it waiting; Discard deletes it.

Who may install an upload

The service's stance (install()): the port is open to every app on the TV, and none of them gets to pick what is signed with the user's certificate. An upload path must not undo that, so POST /install { upload, token } requires a token the service generates at every start and writes into the package's private data folder (.a2s-upload-token, next to the certificate). The page reads it through tizen.filesystem (wgt-private), which no other app on the TV can read, fresh before every upload install so a restarted service still accepts it. If the page cannot read it, the sheet says so and the Install button is disabled; catalog installs are untouched.

The upload page and PUT /upload are open to the LAN like /log.txt (the file sits on the TV until someone at the TV decides; capped, one at a time, logged with the sender's IP). Nothing installs without OK on the remote. README has a section on this.

Tests

• test/manifest.test.js: ids from a .wgt and a .tpk, no-manifest and not-a-zip refused.
• test/upload.test.js: the real service as a child (data folder via TMPDIR): junk and .txt refused, a .wgt stored and named (path traversal in the name stripped), /uploads lists it, install without the token refused (NO_TOKEN), with the token it reaches the signer (no certificate there, so the file keeps waiting), discard clears it.
• Both wired into build-wgt.yml (Node 20 and the TV's 4.4.3) and release.yml; manifest.js in the syntax check. Whole suite passes locally on Node 18.
• Headless Chrome against a mock of the service: the sheet appears when a file arrives, Install sends { upload, token } and lands on the done screen, the no-token case disables Install with the reason, Discard clears it; the real service's upload page rendered at phone size.
• Not run on a TV. The one open question for hardware: whether wgt-private on the page is the same folder as the service's apps_rw/<pkg>/data on every Tizen version (it is where the certificate already lives, per the comments in index.js).

No version bump; that is for the release PR.