Wire desktop updates through a generic feed

electron-builder now publishes latest-linux.yml / latest.yml and embeds
app-update.yml plus package-type, so electron-updater runs pacman -U or
dpkg -i through pkexec for packages and updates the per-user NSIS install
without elevation. The app checks only when asked (menu item), asks before
downloading and before installing, and J621_UPDATE_URL overrides the feed
for tests or forks.

deploy/push_desktop.sh builds and publishes the artifacts to
deploy/data/desktop, which the frontend nginx mounts read-only at
/desktop/. Verified detection and up-to-date handling against a local feed
with the packaged Arch build.

deploy/compose.yml

@@ -99,6 +99,9 @@ services:
       context: ..
       dockerfile: deploy/J621-Frontend
     restart: unless-stopped
+    volumes:
+      # Desktop update feed (deploy/push_desktop.sh): latest*.yml + installers.
+      - ./data/desktop:/usr/share/nginx/html/desktop:ro
 
   nginx:
     image: nginx:1.29-alpine