Fill the window on Linux; updates

- Linux: Tauri packs a window's webviews into one GTK box with equal
  shares and ignores their bounds, so the title bar took half the window.
  The title bar webview now has a fixed height and no share; the box's
  border is the resize frame (none when maximized).
- tauri-plugin-updater: checks llembas.eu/desktop/latest.json at start
  and every 6 h, an update button in the title bar and menu entries,
  .deb via pkexec, AppImage in place, then restart. Packages signed with
  the updater's minisign key; requireSignedVersion on.
  scripts/publish-update.sh signs a GitHub release and writes the manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -27,6 +27,14 @@ chmod +x llembas-desktop_*.AppImage && ./llembas-desktop_*.AppImage
 On GNOME the tray needs the *AppIndicator* extension; without it, the title bar's menu has
 everything, and starting the app again brings a hidden window back.
 
+## Updates
+
+LLeMbas Desktop looks for a new release when it starts and every six hours. When there is one, an
+**update** button appears in the title bar (and *Install LLeMbas x.y.z…* in its menu; *Check for
+updates…* otherwise). Installing asks for your password to update the `.deb` (an AppImage updates
+itself), then the app starts again. Every package is checked against the release signing key
+built into the app before anything is installed.
+
 ## Use
 
 1. Start LLeMbas and enter your server's address. Sign in there as you would in a browser.