Desktop apps — Tauri 2 shells for Windows, macOS and Linux with auto-update

[MA1002643]

Context

Brief §4.2 (installable desktop on Win/macOS/Linux) — the PWA already satisfies installability; this track adds native packaging per §4.5's phased plan: distributable installers, deeper OS media integration, and auto-update, wrapping the same web bundle (§4.4 parity by construction).

Scope

• Tauri 2 shell: loads the production web app (remote-URL mode with offline shell fallback) with a hardened webview config (CSP, restricted IPC allowlist — only the commands below).
• Native integrations behind the existing adapters: media keys + OS "now playing" (SMTC/MPRIS/macOS) via the media-session adapter; tray icon with transport controls; launch-at-login option; single-instance + deep-link handling for share URLs and OAuth callbacks (Social sign-in (Google, Apple) + TOTP multi-factor authentication #33's custom-scheme plan).
• Secure storage: session persistence via OS keychain (Keychain/Credential Manager/libsecret) per brief §10.
• Packaging & updates: signed builds — MSI/NSIS (Windows, code-signing cert), notarised DMG (macOS), AppImage+deb (Linux); Tauri updater with signed manifests, staged rollout channel (beta/stable); CI release pipeline from tags.
• Store submissions where applicable (Microsoft Store; macOS distribution outside MAS initially — documented decision) — kept strictly non-blocking for the web product per §4.5.

Acceptance criteria

• Feature-parity smoke: the M6 cross-browser critical-flow suite passes inside the shells on all three OSes (webdriver against the wrapper).
• Media keys, tray, lock-screen metadata work on each OS; offline downloads play in the shell.
• Auto-update: old build → staged update → new build, signature-verified, resumable (E2E on all three).
• Installers signed/notarised; cold-start to audio-capable < 3 s on reference hardware; shell adds < 30 MB installed.

Technical notes

The wrapper must contain no product logic — a CI check diffing wrapper-exposed IPC surface keeps the shell honest; anything feature-shaped belongs in the web codebase where all platforms get it.

Dependencies

Depends on #41, #29, #45. Blocks #65.