fix(desktop): announce staged updates reliably and install them silently

Two separate reasons "Restart to update" only ever showed up after pressing
"check for updates" by hand, and one reason the restart was unpleasant.

1. `update-downloaded` is a one-shot push to whichever page happens to be
   loaded. It is dropped when the window is in the tray (mainWindow is null),
   when the 10s post-launch check beats the web app's listener registration,
   and on every reload. Once an update is staged the poll latches off, so it
   was never re-announced — a manual check was the only way back. The main
   process already tracks this in recoveryStore, so expose it over IPC and have
   the banner ask on mount rather than rely on catching the event live.

2. UpdateBanner was only mounted in the mobile layout. On the desktop app the
   visible one was UpdateToast, which duplicated the same "update ready" card
   in untranslated English. Mount the banner on desktop too and reduce the
   toast to the failure case it does not share.

3. quitAndInstall() defaults to a non-silent install, so on Windows restarting
   meant clicking through the NSIS wizard. Pass silent + force-run-after, and
   switch the installer to one-click per-user, which is what lets the silent
   install proceed without an elevation prompt.

The manual-download link in the failure toast pointed at the upstream GitHub
repository, which is private for this fork and 404'd for everyone. Point it at
the fork's Gitea releases, where the updater feed already lives.

Regression test covers the case the live event never announced; verified by
mutation that removing the status query fails it and nothing else.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/desktop/electron-builder.yml

@@ -58,5 +58,15 @@ linux:
     - deb
   category: Network
 nsis:
-  oneClick: false
-  allowToChangeInstallationDirectory: true
+  # One-click, per-user install (%LOCALAPPDATA%), the way Discord ships.
+  #
+  # This is what makes an update silent: a per-user install needs no elevation,
+  # so electron-updater can run the installer with /S and no UAC prompt breaks
+  # the flow. The assisted installer we had before (oneClick: false) showed its
+  # wizard on every update and offered an all-users install, which would then
+  # demand elevation on each subsequent update.
+  #
+  # The trade is that a fresh install no longer asks where to put the app.
+  oneClick: true
+  perMachine: false
+  allowToChangeInstallationDirectory: false