0.3.9 — fix plugin registry (backend HTTPS, CORS), fold updater into a status-bar icon

- Plugin catalog/install failed silently: the webview fetch() to Gitea raw is
  blocked by CORS (no ACAO header). Route registry reads through a new Rust
  command registry_http_get (host-restricted) — catalog + installs now work.
- Updater: removed the floating card that overlapped the Terminal/Log/Updates
  buttons. Update state now shows as a single status-bar download icon (no text):
  idle → download glyph, available → accent + dot, checking/downloading → spinner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "exbyte-depot"
-version = "0.3.8"
+version = "0.3.9"
 description = "Exbyte Depot — native Perforce client by Exbyte Studios"
 authors = ["Exbyte Studios"]
 edition = "2021"
@@ -26,6 +26,8 @@ serde_json = "1"
 tauri-plugin-dialog = "2.7.1"
 # decode p4 output on non-UTF8 (ANSI/cp1251) systems — Cyrillic paths
 encoding_rs = "0.8"
+# backend-side HTTPS for the plugin registry (webview fetch is blocked by CORS)
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls"] }
 
 # Auto-updater (desktop only — checks Gitea Releases for a signed new version)
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]