[MEDIUM] Update flow UX: auto-installs with no version, changelog, or error surfacing

[matthewod11-stack]

Description

useUpdateCheck auto-installs updates on click with no version display, no changelog, no confirmation dialog, and errors are never shown to the user (only the installing boolean drives the button).

Current State

• src/hooks/useUpdateCheck.ts:30-40 — calls downloadAndInstall() then relaunch() immediately.
• src/components/layout/AppShell.tsx:118-135 — renders the "Update Available" button but doesn't display updateAvailable.version or updateAvailable.body.
• setInstalling(false) is never reached on success because relaunch() kills the process.
• No error display path.

Suggested Fix

• Add a modal on click that shows: version number, release notes (updateAvailable.body), "Restart to install" / "Later" buttons.
• Surface update errors (network, signature verification failure) in the UI.
• Persist "Later" choice for ~1 day so users aren't nagged on every launch.
• Log all update events (check, download start, install, failure) via the logger (see [HIGH] No structured logging or crash reporter — FATAL errors vanish on Finder-launched .app #30).

Verification

• npm run type-check passes
• Manual: force an update available → modal appears with version + changelog → Later defers for 24h → Restart installs.
• Manual: simulate network failure during download → error displayed.

Automation Hints

scope: src/hooks/useUpdateCheck.ts, src/components/layout/AppShell.tsx, src/components/update/ (new)
do-not-touch: Rust updater code
approach: add-declarations
risk: low
max-files-changed: 5
blocked-by: none
bail-if: none

Priority

Medium — refund-reducing polish; critical for paid desktop apps.