Let an installed copy update itself

[thorstenalpers]

Stacked on #2 — GitHub will retarget this to main once that merges.

#2 builds an installer nobody would ever be told about. This adds the other half.

• The app asks once at start whether a newer version is published, and the Info page grows a card offering to fetch it. Once, not on a timer: something opened to pick a colour has no business interrupting twice an hour, and the answer does not change while it is open. The download waits for a click, because it replaces the binary that is running.
• The release run now signs the installer and writes latest.json beside it — the file every installed copy polls.

One thing to do before the first release, and only you can do it: the private key exists at ~/.tauri/openthemegenerator.key but the workflow reads it from a secret. Set it with

gh secret set TAURI_SIGNING_PRIVATE_KEY < $HOME/.tauri/openthemegenerator.key

The key was generated locally and never passed through the repository, the logs or this diff — only the public half is in tauri.conf.json, which is where it belongs.

Without that secret the release job fails loudly rather than shipping quietly: with a pubkey configured and no private key, tauri build writes the installer and then exits non-zero. That is deliberate — an unsigned build would be refused by the updater in every installed copy.

Verified locally: lint, svelte-check over 998 files, 303 tests, the front-end build, cargo clippy -D warnings and the host tests all clean. The updater itself cannot be exercised until a signed release exists to update from.