In-app updates on Windows

The Microsoft Store doesn't update EXE installs, so the app updates itself
with Tauri's updater. It reads updater/latest.json from the Kestrove Gitea a
minute after startup and once a day. A new version shows as a banner and in
Settings > Updates, and installs only on "Update and restart". The vault locks
before the installer takes over.

The installer must be signed with the Kestrove updater key, with the signature
bound to its version (requireSignedVersion), so a compromised download server
can hold updates back but can't ship one or replay an old installer. Signing
is a release step, after Authenticode: gitea-release.sh signs, uploads the
.sig, and writes latest.json last. Plain builds need no key.

Checks reveal only the IP address and app version, and can be turned off in
Settings. endpoints is a list, so a mirror can be added. Linux packages update
through their package manager.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src-tauri/Cargo.toml

@@ -73,6 +73,8 @@ windows-sys = { version = "0.61", features = [
   "Win32_UI_Input_KeyboardAndMouse",
   "Win32_UI_WindowsAndMessaging",
 ] }
+# In-app updates (updates.rs): signed installers listed in latest.json on the Kestrove Gitea.
+tauri-plugin-updater = "2"
 # Windows Hello (KeyCredentialManager); the same version Tauri already pulls in.
 windows = { version = "0.62", features = ["Foundation", "Security_Credentials", "Security_Cryptography", "Storage_Streams"] }