feat(desktop): signature updater Tauri + wizard persistant + protocole E2E (#77)

- Signature des mises a jour Tauri : paire de cles minisign generee, cle publique dans tauri.conf.json, createUpdaterArtifacts actif, secrets CI exposes (repli build non signe si secret absent).

- Wizard 1er lancement : etat persistant wizard_done cote Rust (get_wizard_state/complete_wizard) pour ne plus reafficher la banniere, retro-compatible.

- Protocole des 6 tests E2E manuels : docs/DESKTOP_E2E_CHECKLIST.md.

- CI : desktop.test.mjs ajoute au job lint.

- Docs : ROADMAP, fiche desktop-tauri, CHANGELOG, README desktop, guide releases.

- fix(build): retirer les libs WeasyPrint inutiles du stage builder Docker.

tests/frontend/desktop.test.mjs

@@ -126,11 +126,30 @@ ok("shouldShowWizard: web → false",
    desktop.shouldShowWizard({ isDesktop: false, dismissed: false, hasVaultPath: false }) === false);
 
 // dismissWizard persists the flag
-desktop.dismissWizard();
+localStorage.clear();
+await desktop.dismissWizard();
 ok("dismissWizard persists flag", localStorage.getItem(desktop.getWizardDismissedKey()) === "1");
 ok("shouldShowWizard reflects dismissed flag via localStorage",
    desktop.shouldShowWizard({ isDesktop: true, hasVaultPath: false }) === false);
 
+// dismissWizard also persists on the Rust side (survives localStorage clear)
+{
+  let called = null;
+  window.__TAURI__ = { core: { invoke: async (cmd) => { called = cmd; return undefined; } } };
+  localStorage.clear();
+  await desktop.dismissWizard();
+  ok("dismissWizard invokes complete_wizard", called === "complete_wizard");
+}
+
+// initDesktopWizard must NOT inject the banner when Rust reports wizard done
+{
+  localStorage.clear();
+  window.__TAURI__ = { core: { invoke: async (cmd) => (cmd === "get_wizard_state" ? true : undefined) } };
+  await desktop.initDesktopWizard();
+  ok("initDesktopWizard skips banner when wizard_done is true",
+     document.getElementById("obsigate-desktop-wizard") === null);
+}
+
 // ── crash banner ────────────────────────────────────────────────────────────
 
 console.log("crash banner");