feat(updater): bake Tauri public key into config; remove key injection steps; bump desktop to 0.1.4

.github/workflows/ci-cd-web-desktop.yml

@@ -332,8 +332,6 @@ jobs:
     name: Desktop Release (Windows)
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     runs-on: [ self-hosted, windows, desktop ]
-    env:
-      TAURI_PUBLIC_KEY: ${{ secrets.TAURI_PUBLIC_KEY }}
     defaults:
       run:
         working-directory: apps/desktop
@@ -364,12 +362,6 @@ jobs:
         with:
           projectPath: apps/desktop
 
-      - name: Inject Tauri public key (post)
-        if: ${{ env.TAURI_PUBLIC_KEY != '' }}
-        shell: pwsh
-        run: |
-          $p = 'apps/desktop/src-tauri/tauri.conf.json'
-          (Get-Content $p) -replace 'REPLACE_WITH_TAURI_PUBLIC_KEY', $env:TAURI_PUBLIC_KEY | Set-Content $p
 
       - name: Upload latest.json + bundles to VPS
         uses: appleboy/scp-action@v0.1.7

.github/workflows/desktop-release.yml

@@ -13,8 +13,6 @@ jobs:
   build:
     name: Build ${{ matrix.platform }}
     runs-on: ${{ matrix.runner }}
-    env:
-      TAURI_PUBLIC_KEY: ${{ secrets.TAURI_PUBLIC_KEY }}
     strategy:
       fail-fast: false
       matrix:
@@ -52,18 +50,6 @@ jobs:
       - name: Install pnpm deps
         run: pnpm -C apps/desktop install --frozen-lockfile
 
-      - name: Inject Tauri public key (Linux/macOS)
-        if: ${{ env.TAURI_PUBLIC_KEY != '' && matrix.platform != 'windows' }}
-        run: |
-          set -euo pipefail
-          sed -i "s/REPLACE_WITH_TAURI_PUBLIC_KEY/${TAURI_PUBLIC_KEY//\//\\\/}/" apps/desktop/src-tauri/tauri.conf.json
-
-      - name: Inject Tauri public key (Windows)
-        if: ${{ env.TAURI_PUBLIC_KEY != '' && matrix.platform == 'windows' }}
-        shell: pwsh
-        run: |
-          $p = 'apps/desktop/src-tauri/tauri.conf.json'
-          (Get-Content $p) -replace 'REPLACE_WITH_TAURI_PUBLIC_KEY', $env:TAURI_PUBLIC_KEY | Set-Content $p
 
       - name: Build desktop
         env: