feat: Desktop auto-updater + release SBOMs

- tauri-plugin-updater + process: pubkey embedded in tauri.conf.json,
  createUpdaterArtifacts, endpoint = GitHub latest.json manifest.
- Connect screen checks before auto-connect (bounded 5s) — a saved
  URL would otherwise navigate away before the check resolves.
  "Update & restart" downloads, verifies minisign, installs, relaunches.
- Release workflow signs updater artifacts with
  TAURI_SIGNING_PRIVATE_KEY secrets, ships the .sig files, and assembles
  latest.json from them. No key → no manifest → no update, never a
  silent unsigned install.
- anchore/sbom-action emits CycloneDX SBOMs per GHCR image plus the
  source tree, attached to every release.

Note: the signing keypair was generated locally
(~/.tauri/primora-updater.key); the private half must be added to repo
secrets before the next release for updates to activate.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.github/workflows/release.yml

@@ -146,6 +146,11 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev patchelf
       - name: Build Tauri bundles
+        # Updater artifacts are minisign-signed; without the key the build
+        # still succeeds but emits no .sig files (updater can't verify them).
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: npm run bundle --workspace @primora/desktop
       - uses: actions/upload-artifact@v4
         with:
@@ -155,8 +160,11 @@ jobs:
             apps/desktop/src-tauri/target/release/bundle/**/*.deb
             apps/desktop/src-tauri/target/release/bundle/**/*.rpm
             apps/desktop/src-tauri/target/release/bundle/**/*.dmg
+            apps/desktop/src-tauri/target/release/bundle/**/*.app.tar.gz
             apps/desktop/src-tauri/target/release/bundle/**/*.msi
             apps/desktop/src-tauri/target/release/bundle/**/*.exe
+            apps/desktop/src-tauri/target/release/bundle/**/*.nsis.zip
+            apps/desktop/src-tauri/target/release/bundle/**/*.sig
           if-no-files-found: error
 
   npm-packages:
@@ -225,6 +233,48 @@ jobs:
             flag
           ' CHANGELOG.md > notes.md
           [ -s notes.md ] || echo "Release ${VERSION}" > notes.md
+      # Tauri updater manifest: one platform entry per signed updater
+      # artifact (AppImage.sig / app.tar.gz.sig / nsis.zip.sig). Missing
+      # sigs mean TAURI_SIGNING_PRIVATE_KEY isn't set — then there is no
+      # manifest and no update, which is correct (never ship unsigned).
+      - name: Build updater manifest (latest.json)
+        run: |
+          python3 - <<'PY'
+          import json, os, glob
+          base = "https://github.com/Dvorinka/Primora/releases/download/%s" % os.environ["VERSION"]
+          platforms = {}
+          for sig in glob.glob("dist-release/**/*.sig", recursive=True):
+              asset = sig[:-4]
+              name = os.path.basename(asset)
+              if name.endswith(".AppImage"):
+                  plat = "linux-x86_64"
+              elif name.endswith(".app.tar.gz"):
+                  plat = "darwin-aarch64" if "aarch64" in name else "darwin-x86_64"
+                  if "aarch64" not in name and "x86_64" not in name:
+                      plat = "darwin-aarch64"  # macos-latest is arm64
+              elif name.endswith(".nsis.zip"):
+                  plat = "windows-x86_64"
+              else:
+                  continue
+              platforms[plat] = {
+                  "signature": open(sig).read().strip(),
+                  "url": f"{base}/{name}",
+              }
+          manifest = {
+              "version": os.environ["VERSION"],
+              "notes": "See the release notes.",
+              "pub_date": __import__("datetime").datetime.now(
+                  __import__("datetime").timezone.utc
+              ).strftime("%Y-%m-%dT%H:%M:%SZ"),
+              "platforms": platforms,
+          }
+          if platforms:
+              with open("dist-release/latest.json", "w") as f:
+                  json.dump(manifest, f, indent=2)
+              print("latest.json:", ", ".join(platforms))
+          else:
+              print("no signed updater artifacts — skipping latest.json")
+          PY
       - name: Create release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -234,6 +284,54 @@ jobs:
           mapfile -t files < <(find dist-release -type f)
           [ ${#files[@]} -gt 0 ] || { echo "no release assets found"; exit 1; }
           gh release create "$VERSION" --title "$VERSION" --notes-file notes.md "${files[@]}"
+          # The manifest must be fetchable at /releases/latest/download/latest.json
+          if [ -f dist-release/latest.json ]; then
+            gh release upload "$VERSION" dist-release/latest.json --clobber
+          fi
+
+  # Software bill of materials — CycloneDX JSON per published image plus
+  # one for the source tree (npm + Go modules). Attached to the release
+  # next to the binaries; downstream consumers can verify provenance.
+  sbom:
+    name: SBOMs
+    needs: [verify, release]
+    if: needs.verify.outputs.needed == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      packages: read
+    env:
+      VERSION: ${{ needs.verify.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: anchore/sbom-action@v0
+        with:
+          image: ghcr.io/${{ github.repository_owner }}/primora-backend:${{ needs.verify.outputs.version }}
+          format: cyclonedx-json
+          output-file: dist-release/sbom-backend.cdx.json
+      - uses: anchore/sbom-action@v0
+        with:
+          image: ghcr.io/${{ github.repository_owner }}/primora-auth:${{ needs.verify.outputs.version }}
+          format: cyclonedx-json
+          output-file: dist-release/sbom-auth.cdx.json
+      - uses: anchore/sbom-action@v0
+        with:
+          image: ghcr.io/${{ github.repository_owner }}/primora-frontend:${{ needs.verify.outputs.version }}
+          format: cyclonedx-json
+          output-file: dist-release/sbom-frontend.cdx.json
+      - uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: dist-release/sbom-source.cdx.json
+      - name: Attach SBOMs to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload "$VERSION" dist-release/sbom-*.cdx.json --clobber
 
   npm-publish:
     name: Publish to npm