Add update notice and require release build secrets

README.md

@@ -31,6 +31,9 @@ cmake --build build -j
 During configure, CMake also checks the app config at
 `$XDG_DATA_HOME/telegram-tui/config.json` or `~/.local/share/telegram-tui/config.json`.
 If that file contains `api_id` and `api_hash`, they are embedded into the build.
+For CI or release builds, prefer setting `TELEGRAM_TUI_BUILD_API_ID` and
+`TELEGRAM_TUI_BUILD_API_HASH` in the environment so credentials come from secrets instead of
+local config.
 
 ## Run
 
@@ -68,7 +71,8 @@ which downloads a prebuilt TDLib bundle from the `shinoa-tdlib` repository using
 version tag such as `v1.8.63`, builds a
 rolling `latest` app release, and publishes an archive containing `usr/bin/shinoa` plus the
 bundled `usr/lib/libtdjson.so*`. The root `PKGBUILD` installs that prebuilt release as
-`shinoa-bin`.
+`shinoa-bin`. That workflow expects Gitea secrets named `TELEGRAM_API_ID` and
+`TELEGRAM_API_HASH`. Release builds are configured to fail if those secrets are missing.
 
 To prepare the TDLib bundle on your own machine: