feat(desktop): signature updater Tauri + wizard persistant + protocole E2E (#77)

- Signature des mises a jour Tauri : paire de cles minisign generee, cle publique dans tauri.conf.json, createUpdaterArtifacts actif, secrets CI exposes (repli build non signe si secret absent).

- Wizard 1er lancement : etat persistant wizard_done cote Rust (get_wizard_state/complete_wizard) pour ne plus reafficher la banniere, retro-compatible.

- Protocole des 6 tests E2E manuels : docs/DESKTOP_E2E_CHECKLIST.md.

- CI : desktop.test.mjs ajoute au job lint.

- Docs : ROADMAP, fiche desktop-tauri, CHANGELOG, README desktop, guide releases.

- fix(build): retirer les libs WeasyPrint inutiles du stage builder Docker.

.gitea/workflows/ci.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Frontend unit tests
         run: node tests/frontend/unit.test.mjs
 
-      - name: Frontend JSDOM tests (PaneManager + Excalidraw + Plugins + AI + SW + Collab + Mobile + Semantic)
+      - name: Frontend JSDOM tests (PaneManager + Excalidraw + Plugins + AI + SW + Collab + Mobile + Semantic + Desktop)
         run: |
           cd tests/frontend
           if [ -d node_modules ]; then
@@ -50,6 +50,7 @@ jobs:
             node collab.test.mjs
             node mobile-editor.test.mjs
             node semantic-search.test.mjs
+            node desktop.test.mjs
           else
             echo "tests/frontend/node_modules missing - installing jsdom"
             npm install --no-audit --no-fund --silent
@@ -61,6 +62,7 @@ jobs:
             node collab.test.mjs
             node mobile-editor.test.mjs
             node semantic-search.test.mjs
+            node desktop.test.mjs
           fi
 
   # ── Tests ─────────────────────────────────────────────────────────

.gitea/workflows/desktop-build.yml

@@ -37,13 +37,27 @@ jobs:
 
       - name: Build MSI
         working-directory: desktop
-        run: cargo tauri build --bundles msi
+        shell: powershell
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          if ([string]::IsNullOrEmpty($env:TAURI_SIGNING_PRIVATE_KEY)) {
+            Write-Host "TAURI_SIGNING_PRIVATE_KEY absent - build sans artefacts de mise a jour."
+            cargo tauri build --bundles msi --config '{"bundle":{"createUpdaterArtifacts":false}}'
+          } else {
+            Write-Host "Signature des artefacts de mise a jour activee."
+            cargo tauri build --bundles msi
+          }
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Upload MSI artifact
         uses: actions/upload-artifact@v4
         with:
           name: obsigate-windows-msi
-          path: desktop/target/release/bundle/msi/*.msi
+          path: |
+            desktop/target/release/bundle/msi/*.msi
+            desktop/target/release/bundle/msi/*.msi.sig
           retention-days: 30
 
       - name: Publish to Gitea Release
@@ -82,11 +96,31 @@ jobs:
 
       - name: Build AppImage
         working-directory: desktop
-        run: cargo tauri build --bundles appimage
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
+            echo "TAURI_SIGNING_PRIVATE_KEY absent - build sans artefacts de mise a jour."
+            cargo tauri build --bundles appimage --config '{"bundle":{"createUpdaterArtifacts":false}}'
+          else
+            echo "Signature des artefacts de mise a jour activee."
+            cargo tauri build --bundles appimage
+          fi
 
       - name: Build deb
         working-directory: desktop
-        run: cargo tauri build --bundles deb
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+        run: |
+          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
+            echo "TAURI_SIGNING_PRIVATE_KEY absent - build sans artefacts de mise a jour."
+            cargo tauri build --bundles deb --config '{"bundle":{"createUpdaterArtifacts":false}}'
+          else
+            echo "Signature des artefacts de mise a jour activee."
+            cargo tauri build --bundles deb
+          fi
 
       - name: Upload Linux artifacts
         uses: actions/upload-artifact@v4
@@ -94,5 +128,7 @@ jobs:
           name: obsigate-linux
           path: |
             desktop/target/release/bundle/appimage/*.AppImage
+            desktop/target/release/bundle/appimage/*.AppImage.sig
             desktop/target/release/bundle/deb/*.deb
+            desktop/target/release/bundle/deb/*.deb.sig
           retention-days: 30