Add OTA updater support for macOS releases

[sdglhm]

Summary

KachaKache currently ships as a downloadable macOS app and DMG, but it does not yet support in-app over-the-air updates. We should add a proper OTA update flow so users can update without manually re-downloading each release.

Goals

• support in-app update checks and installs
• keep the update experience macOS-friendly and trustworthy
• integrate with the GitHub release workflow already used for distribution

Scope

• evaluate the Tauri v2 updater path for macOS
• generate and publish the metadata/artifacts required for OTA updates
• wire update checks into the app UI and menu flow
• document the release-side process and any signing requirements

Acceptance Criteria

• the app can check for a newer version from a configured update endpoint
• a macOS user can download and apply an update in-app
• GitHub release/build automation produces the artifacts needed for OTA delivery
• README documents how OTA releases are published and any required secrets/signing setup

Notes

This likely depends on a signed release pipeline, so it may need to be coordinated with the notarization/signing work.