feat(desktop): signature updater Tauri + wizard persistant + protocole E2E (#77)

- Signature des mises a jour Tauri : paire de cles minisign generee, cle publique dans tauri.conf.json, createUpdaterArtifacts actif, secrets CI exposes (repli build non signe si secret absent).

- Wizard 1er lancement : etat persistant wizard_done cote Rust (get_wizard_state/complete_wizard) pour ne plus reafficher la banniere, retro-compatible.

- Protocole des 6 tests E2E manuels : docs/DESKTOP_E2E_CHECKLIST.md.

- CI : desktop.test.mjs ajoute au job lint.

- Docs : ROADMAP, fiche desktop-tauri, CHANGELOG, README desktop, guide releases.

- fix(build): retirer les libs WeasyPrint inutiles du stage builder Docker.

desktop/tauri.conf.json

@@ -33,6 +33,7 @@
   "bundle": {
     "active": true,
     "targets": "all",
+    "createUpdaterArtifacts": true,
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",
@@ -83,7 +84,7 @@
       "endpoints": [
         "https://git.dracodev.net/api/v1/repos/Projets/ObsiGate/releases/latest"
       ],
-      "pubkey": "OBSIGATE_UPDATE_PUBKEY_PLACEHOLDER",
+      "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDcwQjU2MDM4QUVEREY3NApSV1IwMysyS0ExWUxCK1RQMUgrYnplQWlpYWU2SHVYajVIUHhzNEFKLzZ2Z2puZW9pSUQ2RE8rUAo=",
       "windows": {
         "installMode": "passive"
       }