fix(sdk-update): make UpdateInfo.apkHash nullable to prevent NPE on missing server field

Gson sets absent JSON fields to null even for Kotlin non-null types.
Calling copy() on an UpdateInfo where apkHash is null triggers a
runtime NPE. Declaring the field as String? and passing ?: "" at the
call site is the minimal safe fix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sdk-update/src/main/java/com/xuqm/sdk/update/UpdateSDK.kt

@@ -168,7 +168,7 @@ object UpdateSDK {
                 // 检查该版本 APK 是否已下载到本地（含哈希校验）
                 if (afterIgnore.needsUpdate && afterIgnore.versionCode > 0) {
                     afterIgnore.copy(alreadyDownloaded = isApkDownloaded(
-                        context, afterIgnore.versionCode, afterIgnore.apkHash))
+                        context, afterIgnore.versionCode, afterIgnore.apkHash ?: ""))
                 } else {
                     afterIgnore
                 }

sdk-update/src/main/java/com/xuqm/sdk/update/model/UpdateInfo.kt

@@ -13,6 +13,6 @@ data class UpdateInfo(
     val requiresLogin: Boolean = false,
     /** 该版本 APK 已下载到本地且哈希校验通过，可直接安装 */
     val alreadyDownloaded: Boolean = false,
-    /** APK 文件的 SHA-256 哈希值，用于校验本地文件完整性 */
-    val apkHash: String = "",
+    /** APK 文件的 SHA-256 哈希值，用于校验本地文件完整性；服务端未返回时为 null */
+    val apkHash: String? = null,
 )