feat: in-app auto-update via tauri-plugin-updater + signing pipeline

[hujiulin]

Summary

Add a full version-detection + auto-update flow so users get new releases without ever leaving the app.

---

What's in this PR

🔌 Client side

• Plugins: tauri-plugin-updater + tauri-plugin-process (for relaunch) registered in main.rs; capabilities/default.json grants updater:* + process:allow-restart
• tauri.conf.json: bundle.createUpdaterArtifacts: true + plugins.updater section pointing at the GitHub Releases latest.json endpoint (pubkey left blank for maintainers to fill — see README)
• src/updater.ts: friendly wrapper around check / downloadAndInstall / relaunch. Silent-by-default so a startup auto-check stays quiet, but re-throws when called explicitly so the UI can surface errors
• Store updater slice (store.ts): updateStatus (idle / checking / upToDate / available / downloading / installed / error), latestUpdate, updateProgress, updateError, lastUpdateCheck. Actions: checkForUpdate({silent}), installUpdate(), restartForUpdate(), dismissUpdate(). Auto-runs a silent check 3 s after init

🎨 UI

• AboutPanel.tsx has a new <UpdaterCard> with five visual states:
  • idle / upToDate / checking — version + "Last checked X ago" + Check button
  • available — title + release notes (scrollable) + Install update / Not now
  • downloading — progress bar with KB/MB readout
  • installed — ✓ "Update installed" + Restart now
  • error — ⚠ message + Try again
• Subtle green dot on Sidebar's Settings nav item + on Settings' About sub-tab whenever an update is available

🚀 CI / CD

• .github/workflows/release.yml wires TAURI_SIGNING_PRIVATE_KEY + TAURI_SIGNING_PRIVATE_KEY_PASSWORD env so the bundler signs each updater artifact, and includeUpdaterJson: true emits the latest.json manifest alongside the installers

🧪 Tests (+23 / total 279 across 32 files)

• tests/__mocks__/tauri-updater.ts — in-memory updater plugin with hooks for next update / next error / chunk sizes / download fail
• tests/__mocks__/tauri-process.ts — relaunch spy
• tests/updater.test.ts — wrapper silent vs non-silent, progress streaming, download errors
• tests/store.updater.test.ts — every status transition + error paths + dismiss
• tests/components/AboutPanel.test.tsx — identity + every updater UI state (idle / available / installed / error)

📝 Docs

• Both READMEs gain a new Auto-update setup (maintainers) section walking through the 4-step signing onboarding (generate keypair → embed pubkey → add GH secrets → push tag)
• Feature table picks up a 🔄 Auto-update row

---

Test plan

• npm test green (279/279)
• npm run vite:build passes
• cargo build passes
• CI workflow runs on this PR (see status checks above)
• Manual smoke: npm run dev → Settings → About → click "Check for updates" (will show an error until latest.json exists, which is expected)
• After maintainer adds TAURI_SIGNING_PRIVATE_KEY secret and tags a release: verify latest.json shows up in Releases and the in-app updater flow works end-to-end

---

How users will experience this

1. Launch EchoWise → 3 s later a silent background check runs
2. If a new version exists → a green dot appears next to Settings in the sidebar
3. Open Settings → About → see "Update available — vX.Y.Z" with release notes
4. Click Install update → progress bar → ✓ Installed
5. Click Restart now → app relaunches into the new version