Sync latest TrueGrowth updates

docs/DESKTOP_AUTO_UPDATE.md

@@ -0,0 +1,62 @@
+# TrueGrowth Desktop Auto Updates
+
+## Channel
+
+Stable desktop updates are served from:
+
+```text
+https://truegrowth.benchu.cloud/desktop/stable/
+```
+
+The 1Panel static directory should expose these files directly:
+
+- `latest.yml`
+- `latest-mac.yml`
+- `releases.json`
+- `TrueGrowth-<version>-<arch>.dmg`
+- `TrueGrowth-<version>-<arch>-mac.zip`
+- `TrueGrowth-<version>-x64-Setup.exe`
+- optional portable installers and `.blockmap` files
+
+## Build
+
+```bash
+pnpm desktop:build
+```
+
+For platform-specific builds:
+
+```bash
+pnpm desktop:build:mac
+pnpm desktop:build:win
+```
+
+The build writes artifacts to `dist/desktop/release` and generates `releases.json`
+with sizes, sha256 hashes, and upload guidance.
+
+## 1Panel / Nginx Cache
+
+Set metadata files to no-store:
+
+```nginx
+location ~* ^/desktop/stable/(latest\.yml|latest-mac\.yml|releases\.json)$ {
+  add_header Cache-Control "no-store, no-cache, must-revalidate";
+}
+```
+
+Installers, zip packages, and blockmaps can use long-lived immutable cache:
+
+```nginx
+location ~* ^/desktop/stable/.*\.(dmg|zip|exe|blockmap)$ {
+  add_header Cache-Control "public, max-age=31536000, immutable";
+}
+```
+
+## Production Gate
+
+Customer auto-update packages must be signed before release:
+
+- macOS: Developer ID signed and notarized.
+- Windows: Authenticode signed.
+
+Unsigned packages are only for internal update-flow tests.