macOS auto-update doesn't apply (unsigned/ad-hoc build blocks Squirrel.Mac)

[alpha5611331]

Problem

The 5-minute background update check (auto-updater.service.ts + index.ts) uses electron-updater's built-in autoUpdater, which relies on Squirrel.Mac to apply updates on macOS.

Our mac build config (package.json):

"identity": "-",
"hardenedRuntime": false,
"notarize": false

identity: "-" is ad-hoc signing (not a real Apple Developer ID certificate), and notarization is disabled. Per electron-builder's own docs:

Code signing is a mandatory requirement for auto-updating on macOS. Without proper signing, the update mechanism will not function.

So on macOS the app can check for updates but the actual download/apply step is expected to fail or be silently blocked by Gatekeeper. Windows (NSIS) is unaffected - this is mac-only.

Fix

Real Developer ID signing + notarization is deferred for now. As a stopgap, this adds a manual-download fallback specifically for macOS:

• Check GitHub releases directly (GET /repos/PowerInterviewAI/client-app/releases/latest) instead of going through Squirrel.Mac.
• Download the architecture-matched .dmg asset.
• On user confirmation, quit the app and open the mounted DMG so the user can drag it into Applications manually.

Windows keeps its existing silent NSIS auto-update, untouched.

Follow-up

Once a Developer ID Application certificate is available, re-enable hardenedRuntime/notarize and switch back to the standard Squirrel.Mac silent-update flow.