Hide secondary windows until the login UI is painted, open external links in the default browser, and add signed Githop auto-updates

Hop-State: A_06FPJAAEMY0VXGY9S90PE90
Hop-Proposal: R_06FPJA9RY0ZAWJ1K0K760W8
Hop-Task: T_06FPJ5688NFG8VWKSFCTZEG
Hop-Attempt: AT_06FPJ5688M08V2K0PEFVQX0

README.md

@@ -35,3 +35,29 @@ cargo test --manifest-path src-tauri/Cargo.toml
 - The selected node's complete website experience after authentication.
 
 The node address and HttpOnly website session persist between launches using the native webview's cookie store.
+
+## Auto-updates
+
+Production builds check the newest public release at
+`GnosysLabs/Synapsis-Desktop` on Githop. When a newer signed release is present,
+Synapsis downloads it, verifies it with the embedded updater public key, installs
+it, and relaunches automatically. Development builds do not check for updates.
+
+The encrypted updater private key lives outside this repository at
+`/Users/christopher/.tauri/synapsis-desktop-updater.key`. Matching
+`TAURI_SIGNING_PRIVATE_KEY` and `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` secrets are
+configured for the Githop repository. Never commit the private key or password.
+
+To prepare a macOS update locally:
+
+1. Increment `version` in `src-tauri/tauri.conf.json`, `src-tauri/Cargo.toml`, and
+   `package.json`.
+2. Export `TAURI_SIGNING_PRIVATE_KEY` and
+   `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` for the updater signing key.
+3. Run `bun run release` to build the app, updater archive, and signature.
+4. Run `bun run release:manifest` to create `latest.json` beside the archive.
+5. Create a Githop release tagged `v<version>` and attach
+   `Synapsis.app.tar.gz`, `Synapsis.app.tar.gz.sig`, and `latest.json`.
+
+The release tag and manifest tag must match. Override the defaults with
+`SYNAPSIS_RELEASE_TAG` and `SYNAPSIS_RELEASE_NOTES` when needed.