Add non-intrusive auto-updater

Tauri updater + process plugins. Checks Gitea Releases endpoint a few
seconds after launch; on a newer signed version shows a dismissible
bottom-right banner with download progress and auto-relaunch. Public
signing key in tauri.conf.json; release flow documented in RELEASING.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src-tauri/capabilities/default.json

@@ -10,6 +10,8 @@
     "core:window:allow-minimize",
     "core:window:allow-toggle-maximize",
     "core:window:allow-close",
-    "dialog:default"
+    "dialog:default",
+    "updater:default",
+    "process:default"
   ]
 }