Updater v1 --upgrade + roadmap as flat backlog

Updater: watch-together --upgrade checks updates/manifest.json,
downloads the tarball, verifies sha256, applies over the live
install (extract-temp + delete-first move-over; rename-safe on
Linux while running). Zero Flutter imports, 7 tests incl.
stub-server flows. Version stamped via --dart-define=APP_VERSION
in package script. Warns (never silently jumps) on proto mismatch.
Roadmap: phases retired as tracker (history in git log), now flat
Built/Backlog/Epics/Deferred; Jellyfin next feature, transcode
never; updater expansion stays an epic. Endpoint publishing
(manifest + release tarball) is user-owned.

apps/desktop/pubspec.yaml

@@ -23,6 +23,8 @@ dependencies:
   hive_ce_flutter: ^2.3.4
   image: ^4.9.2
   window_manager: ^0.5.2
+  archive: ^4.0.7
+  crypto: ^3.0.6
 dev_dependencies:
   flutter_test:
     sdk: flutter