feat: add in-app update flow and native e2e verification (#1112)

* feat(app-update): add in-app update flow with native e2e coverage

* docs(ai-workflow): infer closed-issue labels automatically

* fix(app-update): address native updater review findings

* fix(android): validate updater redirect hosts

* fix(electron): harden updater file names

electron/app-updater.test.js

@@ -0,0 +1,24 @@
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('electron', () => ({
+  app: {},
+  shell: {
+    openPath: vi.fn(),
+  },
+}));
+
+const { sanitizeFileName } = await import('./app-updater.js');
+
+describe('app-updater', () => {
+  it('falls back for empty and parent-directory file names', () => {
+    expect(sanitizeFileName('')).toBe('5chan-update');
+    expect(sanitizeFileName('.')).toBe('5chan-update');
+    expect(sanitizeFileName('..')).toBe('5chan-update');
+    expect(sanitizeFileName('../..')).toBe('5chan-update');
+    expect(sanitizeFileName('nested/..')).toBe('5chan-update');
+  });
+
+  it('keeps a normal asset name', () => {
+    expect(sanitizeFileName('5chan-darwin-arm64-v0.7.3.zip')).toBe('5chan-darwin-arm64-v0.7.3.zip');
+  });
+});