feat(desktop): signature updater Tauri + wizard persistant + protocole E2E (#77)

- Signature des mises a jour Tauri : paire de cles minisign generee, cle publique dans tauri.conf.json, createUpdaterArtifacts actif, secrets CI exposes (repli build non signe si secret absent).

- Wizard 1er lancement : etat persistant wizard_done cote Rust (get_wizard_state/complete_wizard) pour ne plus reafficher la banniere, retro-compatible.

- Protocole des 6 tests E2E manuels : docs/DESKTOP_E2E_CHECKLIST.md.

- CI : desktop.test.mjs ajoute au job lint.

- Docs : ROADMAP, fiche desktop-tauri, CHANGELOG, README desktop, guide releases.

- fix(build): retirer les libs WeasyPrint inutiles du stage builder Docker.

frontend/js/desktop.js

@@ -142,8 +142,11 @@ export function shouldShowWizard(opts) {
   return isDesktop && !dismissed && !hasVaultPath;
 }
 
-export function dismissWizard() {
+export async function dismissWizard() {
   try { localStorage.setItem(WIZARD_DISMISSED_KEY, '1'); } catch (e) { /* ignore */ }
+  // Persist on the Rust side too, so clearing the webview's localStorage does
+  // not resurrect the wizard on the next launch.
+  await invoke('complete_wizard');
 }
 
 export function getWizardDismissedKey() { return WIZARD_DISMISSED_KEY; }
@@ -173,9 +176,13 @@ export async function pickAndAddVault() {
 // the user's Obsidian vault folder. Non-blocking; the default vault created
 // by the Rust shell remains available if the user dismisses it.
 
-export function initDesktopWizard() {
+export async function initDesktopWizard() {
   if (typeof window === 'undefined' || typeof document === 'undefined') return;
-  if (!shouldShowWizard({})) return;
+
+  // The authoritative "already done" signal lives in the desktop config
+  // (survives localStorage clears). Defaults to false when not on desktop.
+  const wizardDone = (await invoke('get_wizard_state')) === true;
+  if (!shouldShowWizard({ hasVaultPath: wizardDone })) return;
 
   // Defer so the app shell is fully rendered before injecting the banner.
   setTimeout(function () {
@@ -236,7 +243,7 @@ export async function initDesktopIntegration() {
   } catch (e) { /* ignore */ }
 
   // First-run vault wizard.
-  initDesktopWizard();
+  await initDesktopWizard();
 
   return true;
 }