feat(updates): add in-app auto-updates with restart toast

[kalvinnchau]

In-app auto-updates, ported from block/buzz desktop with its copy.

• src/features/updates/updates.ts is the app-wide update owner. It checks at startup and every 6 hours, skipping while a check, download or install is in progress. Manual checks join an in-flight check. When an update is found it downloads it, then installs and relaunches on request. Background check errors stay silent. Builds without the native updater report that automatic updates aren't available.
• A Ready to update! toast offers Update now once the download finishes. It stays hidden while Settings → Updates is open, because that page shows the same action. Dismissing the toast holds until the update resolves.
• New Settings → Updates section ("Software Updates") with check, retry and apply actions.
• Native: tauri-plugin-updater is registered only in release builds compiled with BUZZ_UPDATER_PUBLIC_KEY and BUZZ_UPDATER_ENDPOINT (the buzz_updater_enabled cfg in build.rs). tauri-plugin-process provides relaunch. The main-window capability grants updater:allow-check, updater:allow-download, updater:allow-install, core:resources:allow-close and process:allow-restart. The JS and Rust updater versions match (2.12.0).
• Docs: docs/configuration.md, docs/settings.md.

Publishing updates needs release configuration: the updater public key and endpoint at build time, a plugins.updater config with createUpdaterArtifacts, the Tauri signing key, updater artifacts signed after notarization, and a published latest.json.

Testing

• updates.test.ts, UpdateNotice.test.tsx, UpdateSettings.test.tsx, Settings.test.tsx: lifecycle, merging, background interval, disposal, error mapping, toast and settings states.
• tests/browser/updates.spec.mjs (Chromium and WebKit) runs the real updater and process JS clients against IPC gated by capabilities/default.json. It covers check, failure and retry, download, restart from the toast, releasing both native resources after a failed install before retrying, and, at the default 1200×800 window, the toast yielding to Settings → Updates.
• pnpm check; Vitest; settings, updates and plugin-import browser specs in both engines; cargo fmt, cargo clippy (with updater env set) and a release tauri build.