feat: add safe signed desktop updates

[kev1n77]

Summary

• add a backend-controlled Tauri updater that accepts only a compile-time trusted public key and the fixed HTTPS GitHub Release endpoint
• recheck the selected version, restore managed proxy settings, return capture to Gateway, and create a restorable SQLCipher snapshot before installation
• add an Updates settings view with availability, release notes, download progress, fail-closed unconfigured state, and minimum-window coverage
• document release signing inputs and update SEC-004 / REL-001 progress

Verification

• npm run desktop:check (46 tests)
• npm run desktop:build
• npx playwright test --config apps/desktop/playwright.config.ts -g "signed update controls"
• python scripts/verify_supply_chain.py
• python -m unittest discover -s scripts/tests -v
• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• cargo metadata --manifest-path apps/desktop/src-tauri/Cargo.toml --no-deps --format-version 1

Full native tests are delegated to CI because the local vendored OpenSSL build requires Perl modules not present in the workstation Git distribution.