0.3.9 — fix plugin registry (backend HTTPS, CORS), fold updater into a status-bar icon

- Plugin catalog/install failed silently: the webview fetch() to Gitea raw is
  blocked by CORS (no ACAO header). Route registry reads through a new Rust
  command registry_http_get (host-restricted) — catalog + installs now work.
- Updater: removed the floating card that overlapped the Terminal/Log/Updates
  buttons. Update state now shows as a single status-bar download icon (no text):
  idle → download glyph, available → accent + dot, checking/downloading → spinner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/p4.ts

@@ -113,6 +113,7 @@ export const p4 = {
   pluginReadEntry: (id: string) => invoke<string>("plugin_read_entry", { id }),
   pluginSetEnabled: (id: string, enabled: boolean) => invoke<void>("plugin_set_enabled", { id, enabled }),
   pluginWriteFile: (id: string, name: string, content: string) => invoke<void>("plugin_write_file", { id, name, content }),
+  registryHttpGet: (url: string) => invoke<string>("registry_http_get", { url }),
   pluginInstall: (src: string) => invoke<string>("plugin_install", { src }),
   pluginRemove: (id: string) => invoke<void>("plugin_remove", { id }),
   pluginsDirPath: () => invoke<string>("plugins_dir_path"),