Sync (#149)

* Add encrypted sync via Nostr relay with NIP-CF changes feed

Sync engine (sync.rs) connects to a configured relay via WebSocket,
authenticates with NIP-42, and subscribes to NIP-CF CHANGES feed for
gift-wrapped (NIP-59) events. Notes are encrypted end-to-end — the
relay only sees opaque kind:1059 blobs.

- SyncManager as Tauri managed state with auto-start on app launch
- Note-to-event mapping: notes become kind:30023 rumors, sealed and
  gift-wrapped to self with NIP-44 encryption
- Bidirectional sync: local mutations push to relay with 2s debounce,
  remote changes upsert locally with last-write-wins resolution
- Echo prevention via recently-pushed event ID tracking
- Exponential backoff reconnection on disconnect
- Sync state reset on relay or identity change
- DB migration adds sync_event_id column for deletion targeting
- Sync status indicator in sidebar (cloud icons for connected/syncing/error/disconnected)
- Seed script updated with stable test keypair and sync_event_id column

* formatting

* fix package issue

* Fix sync deletion to pre-fetch event ID before local delete

The sync_event_id must be read before delete_note_permanently destroys
the row, and the deletion push should only fire after the local delete
succeeds. Pass the pre-fetched ID through the SyncCommand to avoid a
redundant query against a now-missing row.

* Add Apple code signing and notarization to CI builds on master

* Add GitHub release with DMG artifacts on push to master

After the build matrix completes, a release job collects the aarch64
and x86_64 DMGs and publishes them as a GitHub release tagged by
commit SHA.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ChristianChiarulli

.github/workflows/ci.yml

@@ -35,8 +35,10 @@ jobs:
         include:
           - platform: macos-latest
             args: --target aarch64-apple-darwin
+            arch: aarch64
           - platform: macos-latest
             args: --target x86_64-apple-darwin
+            arch: x86_64
 
     runs-on: ${{ matrix.platform }}
     steps:
@@ -63,5 +65,46 @@ jobs:
 
       - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APPLE_CERTIFICATE: ${{ github.event_name == 'push' && secrets.APPLE_CERTIFICATE || '' }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ github.event_name == 'push' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }}
+          APPLE_SIGNING_IDENTITY: ${{ github.event_name == 'push' && secrets.APPLE_SIGNING_IDENTITY || '' }}
+          APPLE_ID: ${{ github.event_name == 'push' && secrets.APPLE_ID || '' }}
+          APPLE_PASSWORD: ${{ github.event_name == 'push' && secrets.APPLE_PASSWORD || '' }}
+          APPLE_TEAM_ID: ${{ github.event_name == 'push' && secrets.APPLE_TEAM_ID || '' }}
         with:
           args: ${{ matrix.args }}
+
+      - name: Upload DMG artifact
+        if: github.event_name == 'push'
+        uses: actions/upload-artifact@v4
+        with:
+          name: dmg-${{ matrix.arch }}
+          path: src-tauri/target/${{ matrix.arch }}-apple-darwin/release/bundle/dmg/*.dmg
+
+  release:
+    if: github.event_name == 'push'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all DMG artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: artifacts
+          pattern: dmg-*
+          merge-multiple: true
+
+      - name: Create release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: build-${{ github.sha }}
+          name: Build ${{ github.sha }}
+          body: |
+            Automated build from commit ${{ github.sha }}.
+          files: artifacts/*.dmg
+          make_latest: true