Wire desktop updates through a generic feed

electron-builder now publishes latest-linux.yml / latest.yml and embeds
app-update.yml plus package-type, so electron-updater runs pacman -U or
dpkg -i through pkexec for packages and updates the per-user NSIS install
without elevation. The app checks only when asked (menu item), asks before
downloading and before installing, and J621_UPDATE_URL overrides the feed
for tests or forks.

deploy/push_desktop.sh builds and publishes the artifacts to
deploy/data/desktop, which the frontend nginx mounts read-only at
/desktop/. Verified detection and up-to-date handling against a local feed
with the packaged Arch build.

deploy/README.md

@@ -136,6 +136,18 @@ Push multi-arch images to the Gitea registry:
 They tag `:latest` and `:<commit-sha>` and expect `docker login
 gitea.rainbow-herring.ts.net` to succeed.
 
+Push the desktop builds and their update metadata to the frontend's feed:
+
+```bash
+./push_desktop.sh            # Linux packages (deb + pacman)
+./push_desktop.sh --win      # also cross-build the NSIS installer (wine)
+```
+
+Artifacts land in `deploy/data/desktop/`, which the frontend nginx mounts
+read-only and serves at `/desktop/`. The desktop app's "Check for updates…"
+menu item reads `latest-linux.yml` / `latest.yml` from there (see
+`desktop/README.md`). Backend-only composes have no frontend, so no feed.
+
 ## Scheduled jobs
 
 Compose files with a backend also run a **`scheduler`** service — the same