feat(desktop): in-app remote upgrade — 檢查更新 button + signed updater

[brettchien]

Wires the app side of remote-upgrade (ADR-7): the installed OAB Studio can pull the signed nightly bundle from the GitHub release and replace itself in place — the "upgrade button" ask.

Stacked on #9 (feat/desktop-mcp-sidecar), since the Tauri shell + version stamp live there. Merge after #9 (→ #10).

What's in it

• src-tauri — register tauri-plugin-updater; two commands check_update / install_update, driven from Rust (so the web skin stays free of the updater JS package — same bridge pattern as start_core/deploy_list). install_update downloads, verifies the minisign signature against the embedded pubkey, then app.restart()s into the new build.
• tauri.conf.json — plugins.updater endpoint (the rolling nightly release's latest.json) + public key; bundle.createUpdaterArtifacts so CI emits the signed .app.tar.gz.
• console — topbar 「檢查更新」 button: first click checks; if a newer build exists it becomes 「更新到 v… ↻」 (install + restart). Progress/errors log to the Activity pane. Desktop-only (hidden in the browser build).

Signing / release side (separate PR)

• Private key + password are stored as repo Actions secrets (TAURI_SIGNING_PRIVATE_KEY / _PASSWORD); public key is embedded here.
• PR ci(nightly): rolling nightly desktop build pinned to main #14 was updated to sign the bundle and publish latest.json on the nightly release (forward-compatible: inert until this app is on main).

Verification

• Console: tsc clean, vitest 8/8, vite build OK (button string in bundle).
• Rust compile is gated by the macOS CI — the ephemeral Linux build box lacks the GTK libs Tauri's linux backend pulls in, so local cargo check can't complete. API usage is standard tauri-plugin-updater v2.

Sequencing to make it live

1. feat(desktop): host oab-mcp core as a bundled MCP sidecar (macOS-only) #9 sidecar → main 2. feat(desktop): Config tab to pin oab-mcp target + reload core #10 config tab → main 3. this PR → main 4. ci(nightly): rolling nightly desktop build pinned to main #14 nightly → main
   Once all four are on main, a nightly publishes a signed latest.json and the button upgrades to it.

🤖 Generated with Claude Code