Desktop self-update from GitHub Releases (opt-in)

[Manwe-777]

Wires up Tauri 2's updater so the desktop app can update itself from GitHub Releases. Exploratory — safe to sit on / reject; it stays completely dormant until a signing key is added, so it changes nothing about current builds or the dev loop.

What it does

• On startup (Tauri only), checks the release manifest. If a newer signed build exists, a header pill "Update to vX.Y.Z" appears → click → download, install, relaunch.
• The web/PWA build already updates via its service worker, so this only affects the downloaded desktop app.

Why it's safe to merge even if unsure

• Frontend check is best-effort + silent. In the browser, during tauri:dev, on an unsigned build, or offline, check() throws/returns null and UpdateBanner renders nothing. Plugin modules are dynamically imported, so the web bundle never pulls in Tauri internals.
• Signing is gated behind a secret. build.yml only applies tauri.conf.updater.json (which turns on createUpdaterArtifacts + latest.json) when TAURI_SIGNING_PRIVATE_KEY is set. Tag a release without it → still builds fine, just no self-update. No footgun.

To actually enable it (all free)

The updater's minisign key is free and separate from the paid OS code-signing certs:

1. pnpm tauri signer generate -w ~/.tauri/pidtuna.key
2. Add repo secrets TAURI_SIGNING_PRIVATE_KEY + TAURI_SIGNING_PRIVATE_KEY_PASSWORD.
3. Replace the throwaway placeholder plugins.updater.pubkey in src-tauri/tauri.conf.json with your public key. (The placeholder's private key was discarded.)

Per-platform reality (free minisign key, no paid certs)

• Linux — clean, AppImage only (.deb/.rpm never self-update).
• Windows — works; SmartScreen prompt each update unless Authenticode-signed.
• macOS — works, but without Apple notarization Gatekeeper quarantine can make updates flaky ("app is damaged"). Fine for personal/beta; notarize for a smooth public UX.

See the new README "In-app auto-update" section for details.

Verification

• pnpm typecheck + pnpm build: clean.
• cargo check (src-tauri): clean — updater + process plugins compile.

🤖 Generated with Claude Code