0.3.9 — fix plugin registry (backend HTTPS, CORS), fold updater into a status-bar icon

- Plugin catalog/install failed silently: the webview fetch() to Gitea raw is
  blocked by CORS (no ACAO header). Route registry reads through a new Rust
  command registry_http_get (host-restricted) — catalog + installs now work.
- Updater: removed the floating card that overlapped the Terminal/Log/Updates
  buttons. Update state now shows as a single status-bar download icon (no text):
  idle → download glyph, available → accent + dot, checking/downloading → spinner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

package.json

@@ -1,7 +1,7 @@
 {
   "name": "exbyte-depot",
   "private": true,
-  "version": "0.3.8",
+  "version": "0.3.9",
   "type": "module",
   "scripts": {
     "dev": "vite",