Auto-update: download + install + restart

- CheckForUpdates binding returns version string if newer available
- InstallUpdate binding downloads zip, extracts, replaces app, restarts
- checkUpdates goroutine polls every 6h, shows dialog with version
- make install copies .app to /Applications
- Update script: quit app → sleep → replace .app → relaunch

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build webhook test test-db lint generate generate-check dev migrate seed export clean tidy ui desktop desktop-package desktop-release
+.PHONY: build webhook test test-db lint generate generate-check dev migrate seed export clean tidy ui desktop desktop-package install
 
 BINARY := oikos
 GO ?= go
@@ -74,9 +74,10 @@ desktop-package: desktop   ## Build + package the desktop app (zip on macOS, tar
 	esac
 	@echo "Package: cmd/desktop/build/bin/"
 
-desktop-release: ui   ## Build desktop app for macOS arm64 + Linux amd64 (CI target)
-	@echo "Use 'make desktop-package' for local builds; desktop-release is for CI"
-	@exit 1
+install: desktop-package   ## Install to /Applications
+	rm -rf /Applications/oikos-desktop.app
+	cp -r cmd/desktop/build/bin/oikos-desktop.app /Applications/
+	@echo "Installed to /Applications/oikos-desktop.app"
 
 clean:
 	rm -f $(BINARY)