Desktop client: code-signed installers + auto-update + download page

[ahmetabdullahgultekin]

Why: Desktop currently produces unsigned builds only; there is no distribution channel.

Done when:

• Code-signed installers: Windows Authenticode (OV cert; interim unsigned + documented SmartScreen override) and a Linux GPG-signed .deb with pubkey on fivucsas.com/pgp.asc (Desktop gap docs: strip iOS/macOS from forward roadmap (out of scope, no Apple hardware) #11, ~4 d).
• Auto-update: hand-rolled update.fivucsas.com/desktop/manifest.json channel checked on launch (Desktop gap docs: add SECURITY.md and LICENSE (T4.12.a/b) #12, ~3 d).
• fivucsas.com/download page listing .msi (x64) + .deb (x64) with SHA256 per artifact (Desktop gap docs: tenant onboarding playbook + 8 ADRs + hierarchy consolidation (DOC_AUDIT_2026-05-04 T4.12.d/e/f) #13, ~1 d).

source: plans/CLIENT_APPS_PARITY.md:144

---

Migrated from plans/CLIENT_APPS_PARITY.md (git history retains the original).