fix(tools): improve tarball download reliability with fallback URLs

GitHub's tarball endpoints can return 403/404 for various reasons:
- Rate limiting
- Branch/tag name conflicts
- API URL format changes

Now tries multiple URL formats in order:
1. /archive/refs/tags/{tag}.tar.gz (explicit ref)
2. /archive/{tag}.tar.gz (legacy format)
3. API-provided tarball_url (authenticated fallback)

Fixes #9949 (Joplin Server 403 errors on tarball download)

misc/build.func

@@ -2148,8 +2148,8 @@ install_script() {
         header_info
         echo -e "${DEFAULT}${BOLD}${BL}Using App Defaults for ${APP} on node $PVEHOST_NAME${CL}"
         METHOD="appdefaults"
-        load_vars_file "$(get_app_defaults_path)"
         base_settings
+        load_vars_file "$(get_app_defaults_path)"
         echo_default
         defaults_target="$(get_app_defaults_path)"
         break

misc/core.func

@@ -828,7 +828,7 @@ cleanup_lxc() {
   # Ruby gem
   if command -v gem &>/dev/null; then $STD gem cleanup || true; fi
   # Composer (PHP)
-  if command -v composer &>/dev/null; then COMPOSER_ALLOW_SUPERUSER=1 && $STD composer clear-cache || true; fi
+  if command -v composer &>/dev/null; then $STD composer clear-cache || true; fi
 
   if command -v journalctl &>/dev/null; then
     $STD journalctl --vacuum-time=10m || true

misc/tools.func

@@ -1752,13 +1752,30 @@ function fetch_and_deploy_gh_release() {
 
   ### Tarball Mode ###
   if [[ "$mode" == "tarball" || "$mode" == "source" ]]; then
-    # GitHub API's tarball_url/zipball_url can return HTTP 300 Multiple Choices
-    # when a branch and tag share the same name. Use explicit refs/tags/ URL instead.
-    local direct_tarball_url="https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz"
+    # Try multiple tarball URL formats for maximum compatibility
+    local tarball_urls=(
+      "https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz"
+      "https://github.com/$repo/archive/$tag_name.tar.gz"
+    )
+    
+    # Also try API-provided tarball_url as fallback
+    local api_tarball_url=$(echo "$json" | jq -r '.tarball_url // empty')
+    [[ -n "$api_tarball_url" ]] && tarball_urls+=("$api_tarball_url")
+    
     filename="${app_lc}-${version}.tar.gz"
+    local download_success=false
 
-    curl $download_timeout -fsSL -o "$tmpdir/$filename" "$direct_tarball_url" || {
-      msg_error "Download failed: $direct_tarball_url"
+    for url in "${tarball_urls[@]}"; do
+      msg_debug "Attempting download from: $url"
+      if curl $download_timeout -fsSL -w "%{http_code}" -o "$tmpdir/$filename" "$url" 2>/dev/null | grep -q "^200$"; then
+        download_success=true
+        break
+      fi
+      rm -f "$tmpdir/$filename"
+    done
+
+    if ! $download_success; then
+      msg_error "Download failed from all tarball URLs for $repo $tag_name"
       rm -rf "$tmpdir"
       return 1
     }