fix(update-service): 非灰度版本对匿名用户可见

原逻辑在 allowAnonymousCheck=false 且 userId=null 时直接返回
needsUpdate=false，导致无登录流程的应用（如 clinical-android）
永远收不到更新提示。

修正为：只有灰度版本才需要 userId；非灰度已发布版本对所有调用
方可见，allowAnonymousCheck=false 仅在非灰度场景下补充拦截。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

update-service/src/main/java/com/xuqm/update/controller/AppVersionController.java

@@ -58,9 +58,6 @@ public class AppVersionController {
             @RequestParam(required = false) String userId) {
 
         boolean allowAnonymousCheck = publishConfigService.allowAnonymousUpdateCheck(appKey);
-        if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
-            return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
-        }
 
         Optional<AppVersionEntity> latest = versionRepository
                 .findTopByAppKeyAndPlatformAndPublishStatusAndVersionCodeGreaterThanOrderByVersionCodeDesc(
@@ -75,13 +72,22 @@ public class AppVersionController {
 
         AppVersionEntity v = latest.get();
 
-        // Gray release filtering
+        // Gray release: userId is required when anonymous checks are disabled and version is gray-targeted.
-        if (!allowAnonymousCheck && v.isGrayEnabled() && userId != null && !userId.isBlank()) {
+        // Non-gray published versions are visible to all callers regardless of userId.
+        if (v.isGrayEnabled()) {
+            if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
+                return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
+            }
+            if (userId != null && !userId.isBlank()) {
                 boolean inGray = isInGrayRelease(v, userId);
                 if (!inGray) {
                     return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
                 }
             }
+        } else if (!allowAnonymousCheck && (userId == null || userId.isBlank())) {
+            // App explicitly requires login to check for updates even without gray targeting.
+            return ResponseEntity.ok(ApiResponse.success(Map.of("needsUpdate", false)));
+        }
 
         String appStoreJumpUrl = hasText(v.getAppStoreUrl())
                 ? v.getAppStoreUrl()