feat: auto-update UX for Windows, Linux AppImage, and macOS

[Ron537]

Summary

Adds the missing user-facing auto-update experience on top of the existing electron-updater wiring. Windows and Linux AppImage now get true auto-install with a one-click "Restart and install" banner; macOS and .deb builds (where in-place replacement isn't safe today) get a "notify + open download page" fallback with a persisted "Skip this version" so users aren't nagged every launch.

Highlights

• Update banner at bottom-right when something is ready, two flavors driven by installMode:
  • autoInstall (Win / Linux AppImage): "Restart and install" → quitAndInstall.
  • manualDownload (macOS / .deb): "Open download page" → opens the GitHub release; secondary "Skip this version" persists in settings.
• About tab in Settings shows version, platform, last-checked time, status, and a manual "Check for updates" button.
• Periodic re-check every 6 hours after launch (skipped while a check is in flight or once a download is pending/installing).
• Logging via electron-log so update failures land in a rotating file users can attach to bug reports.

Architecture

• src/preload/updateTypes.ts — single shared type (UpdateState, UpdateStatus, InstallMode) used by main, preload, and renderer.
• src/main/services/updateState.ts — pure reducer with forward-only guards. Capability flags (canCheck, canInstall, canOpenDownload) are derived deterministically so the renderer never re-derives platform rules.
• src/main/services/autoUpdater.ts — rewritten as a thin wrapper around electron-updater that dispatches reducer actions and broadcasts state via app:updateStateChanged. Platform routing:
  • darwin → manualDownload (both autoDownload and autoInstallOnAppQuit set to false).
  • win32 → autoInstall.
  • linux → autoInstall iff process.env.APPIMAGE, else manualDownload.
• Release URLs are built in main from a constant base — never accepted from the renderer.
• Renderer useUpdateStore subscribes to push events first and seeds from getUpdateState only when state is still null, so a slow snapshot reply can't clobber a newer pushed event during App mount.

macOS workaround rationale

Squirrel.Mac validates that the running bundle's code-signature certificate matches the replacement's. Ad-hoc signed builds use ephemeral identifiers, so the swap is rejected. Until Developer ID signing + notarization land, macOS uses the manual flow. Removing the macOS branch is a one-line change in resolveInstallMode() once signing is in place.

Testing

• ✅ 16 reducer transitions covered in tests/unit/update-state.test.ts (full state machine, the new forward-only guards, capability derivation, and shouldSkipPeriodicCheck).
• ✅ Existing 10 Playwright e2e tests pass against the new build.
• ✅ npm run typecheck clean.

Code review

Two parallel code-review agents (Claude Opus + GPT-5.5) flagged two real issues, both fixed in this branch:

1. Reducer didn't guard available / download-progress / downloaded from regressing terminal-pending states (e.g., a stale update-available event could move downloaded back to available). Added forward-only guards + 5 new tests covering them.
2. Renderer init() could clobber a newly-pushed state with a slow getUpdateState() reply. Now subscribes first and only seeds when state is still null.

What's next (out of scope)

• Developer ID signing + notarization for macOS — once that lands, drop the macOS branch in resolveInstallMode() so darwin uses autoInstall like everyone else.
• Optional release-channel switcher in the About tab. Today allowPrerelease is implicitly driven by whether the running version contains a - (semver prerelease) — fine for a sub-1.0 product but worth exposing later.