Let an installed copy update itself

[thorstenalpers]

Replaces #3, which was merged into fix/cookie-and-release instead of main. My mistake: I said GitHub would retarget a stacked PR once its base merged, and it only does that when the base branch is deleted on merge. It was not, so the updater landed on a branch nobody reads. Same commit, replayed onto main.

#2 builds an installer nobody would ever be told about. This is the other half:

• The app asks once at start whether a newer version is published, and the Info page grows a card offering to fetch it. Once, not on a timer — something opened to pick a colour has no business interrupting twice an hour, and the answer does not change while it is open. The download waits for a click, because it replaces the running binary.
• The release run signs the installer and writes latest.json beside it, which is the file every installed copy polls.

Before the first release, and only you can do it — it is your private key:

gh secret set TAURI_SIGNING_PRIVATE_KEY < $HOME/.tauri/openthemegenerator.key

The key was generated locally, never passed through the repository, the logs or any diff. Only the public half is in tauri.conf.json, where it belongs.

Without the secret the release job fails loudly rather than shipping quietly: with a pubkey configured and no private key, tauri build writes the installer and then exits non-zero. Deliberate — an unsigned build is refused by the updater in every installed copy.

Verified on this branch: lint, svelte-check over 998 files, 303 tests, the front-end build, cargo fmt --check, clippy -D warnings and the host tests. The updater path itself cannot be exercised until a signed release exists to update from.