feat: Mac-only auto-update via treq.dev/version

[Ziinc]

Summary

Adds automatic update checking against the marketing-site /version endpoint, with install enabled on macOS only.

Behavior

• On startup (macOS builds), treq fetches https://treq.dev/version and compares it to the treq crate version.
• When a newer version is published, a persistent toast offers Install and restart.
• Confirming downloads the matching GitHub release artifact (treq_{aarch64|x64}.app.tar.gz), replaces the running .app bundle via ditto, and relaunches.
• Help → Check for Updates… and Settings → Application → Check for updates trigger a manual check (non-macOS shows that auto-update is macOS-only).

Implementation notes

• Core logic lives in src-tauri/src/core/auto_update.rs (TDD’d: semver parse/compare, URL construction, fetcher injection, Mac-only install gate).
• Thin Tauri commands: check_for_app_update, install_app_update (trusted GitHub release URL prefix only).
• NAPI dispatch wires check_for_app_update via core::app_version() so tests see the same version as the desktop app.
• Screenshot QA: scripts/screenshot/specs/auto-update-settings.spec.tsx.

Out of scope

• Windows/Linux install paths (supported is false).
• Tauri updater plugin / signed .sig artifacts (uses existing unsigned .app.tar.gz release assets).

Screenshots

Settings Check for updates
macOS-only toast
Install and restart toast
_{To show artifacts inline, enable in settings.}

  

[cursor]

UI stays out of the Rust install path: the hook only decides when to prompt and confirm.

• Startup check is delayed ~2.5s so it doesn’t contend with first-paint repo load
• autoCheck / listenMenu let Settings reuse the same prompt without double-subscribing to Help → Check for Updates
• Actionable toasts no longer auto-dismiss (see toast.tsx) so “Install and restart” survives until the user acts

[cursor]

Command layer stays thin on purpose — validate + delegate, no business logic.

• TREQ_WEB_URL override keeps local/dev checks pointed at a non-prod origin when needed
• Download URL allowlist is limited to github.com/treq-dev/treq/releases/download/ so a compromised /version host can’t redirect installs elsewhere
• app.restart() after ditto is what actually picks up the replaced bundle on macOS

[cursor]

Version discovery is intentionally a plain-text fetch of /version rather than Tauri’s signed updater protocol — that endpoint already ships on treq.dev and keeps the check independent of release-asset signing.

• Semver + URL builders are pure so CI can cover them without network I/O
• Install stays behind auto_update_supported() (cfg(target_os = "macos")) so Linux/Windows builds compile the same code but never download
• Download URLs mirror the existing GitHub asset names (treq_aarch64 / treq_x64)