0.3.9 — fix plugin registry (backend HTTPS, CORS), fold updater into a status-bar icon

- Plugin catalog/install failed silently: the webview fetch() to Gitea raw is
  blocked by CORS (no ACAO header). Route registry reads through a new Rust
  command registry_http_get (host-restricted) — catalog + installs now work.
- Updater: removed the floating card that overlapped the Terminal/Log/Updates
  buttons. Update state now shows as a single status-bar download icon (no text):
  idle → download glyph, available → accent + dot, checking/downloading → spinner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src-tauri/src/lib.rs

@@ -2987,6 +2987,25 @@ async fn plugin_write_file(id: String, name: String, content: String) -> Result<
     Ok(())
 }
 
+/// Fetch text from the Exbyte plugin registry over HTTPS on the backend — the
+/// webview `fetch()` is blocked by CORS (Gitea raw sends no ACAO header), so the
+/// plugin catalog and installs go through here. Restricted to the trusted host.
+#[tauri::command]
+async fn registry_http_get(url: String) -> Result<String, String> {
+    if !url.starts_with("https://gitea.exbytestudios.com/") {
+        return Err("Only the Exbyte registry host is allowed".into());
+    }
+    let client = reqwest::Client::builder()
+        .user_agent("ExbyteDepot")
+        .build()
+        .map_err(|e| e.to_string())?;
+    let resp = client.get(&url).send().await.map_err(|e| e.to_string())?;
+    if !resp.status().is_success() {
+        return Err(format!("HTTP {}", resp.status().as_u16()));
+    }
+    resp.text().await.map_err(|e| e.to_string())
+}
+
 fn copy_dir_recursive(from: &std::path::Path, to: &std::path::Path) -> std::io::Result<()> {
     std::fs::create_dir_all(to)?;
     for e in std::fs::read_dir(from)? {
@@ -3146,6 +3165,7 @@ pub fn run() {
             plugin_read_entry,
             plugin_set_enabled,
             plugin_write_file,
+            registry_http_get,
             plugin_install,
             plugin_remove,
             plugins_dir_path,