feat: open Markdown files and in-app updater

Markdown:
- File > Open Markdown File... and welcome-screen 'Open .md' import
  one or more .md files as new books (named after first H1 or the
  filename; originals never modified, collision-safe folder names).
- Book dirs and .md files passed on the command line or via desktop
  file associations now open directly; single-instance lock forwards
  second launches to the running window.

Updates:
- File > Check for Updates... and welcome-screen 'Update' button:
  queries the Gitea releases API, one-click installs a newer release
  into ~/.local/share/Folio via a detached swap script that waits for
  app exit, keeps the old tree until the swap succeeds, and relaunches.
  Download is gzip-verified and restricted to the trusted release host.
  No root, no reinstall.

Tests: 19 new assertions in tests/run-update-import-test.mjs (wired
into npm test); full suite green, tsc clean.

tests/run-update-import-test.mjs

@@ -0,0 +1,67 @@
+import esbuild from "esbuild";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import url from "url";
+
+await esbuild.build({
+  entryPoints: ["src/main/update.ts"],
+  bundle: true, platform: "node", format: "esm",
+  outfile: "/tmp/folio-smoke-update.mjs", external: ["electron"], logLevel: "silent",
+});
+await esbuild.build({
+  entryPoints: ["src/main/import-md.ts"],
+  bundle: true, platform: "node", format: "esm",
+  outfile: "/tmp/folio-smoke-import.mjs", external: ["electron"], logLevel: "silent",
+});
+const u = await import(url.pathToFileURL("/tmp/folio-smoke-update.mjs").href);
+const m = await import(url.pathToFileURL("/tmp/folio-smoke-import.mjs").href);
+
+let fails = 0;
+const assert = (c, msg) => { if (!c) { console.error("FAIL -", msg); fails++; } else console.log("ok -", msg); };
+
+assert(u.isNewer("0.2.0", "0.1.0"), "0.2.0 newer than 0.1.0");
+assert(!u.isNewer("v0.1.0", "0.1.0"), "same version not newer (v-prefix tolerated)");
+assert(u.isNewer("0.1.10", "0.1.9"), "numeric compare not lexicographic");
+
+const rel = u.parseRelease({
+  tag_name: "v0.2.0",
+  assets: [
+    { name: "Folio-0.2.0-linux.tar.gz", browser_download_url: "https://git.atitlan.io/avi/Folio/releases/download/v0.2.0/Folio-0.2.0-linux.tar.gz" },
+    { name: "Folio-0.1.0.AppImage", browser_download_url: "https://git.atitlan.io/x/Folio.AppImage" },
+  ],
+});
+assert(rel.version === "0.2.0", "release version parsed");
+assert(u.pickAsset(rel.assets).name.includes("linux"), "picks linux tar.gz over AppImage");
+assert(u.isTrustedDownloadUrl("https://git.atitlan.io/a/t.tar.gz", "https://git.atitlan.io"), "same-host trusted");
+assert(!u.isTrustedDownloadUrl("https://evil.io/t.tar.gz", "https://git.atitlan.io"), "cross-host rejected");
+let threw = false;
+try { u.parseRelease({ message: "not found" }); } catch { threw = true; }
+assert(threw, "error payload without tag throws");
+
+const sh = u.buildInstallerScript({ pid: 1234, tarball: "/tmp/it's.tar.gz", installDir: "/home/a/.local/share/Folio", relaunch: "/home/a/.local/bin/folio" });
+assert(sh.includes(`'/tmp/it'\\''s.tar.gz'`), "shQuote escapes embedded single quote");
+assert(sh.includes("kill -0"), "installer waits for app pid");
+assert(sh.includes("-xzf"), "installer extracts gz");
+
+assert(m.mdTitle("# My Heading\nbody", "file") === "My Heading", "title from H1");
+assert(m.mdTitle("no heading", "file") === "file", "title falls back to filename stem");
+
+const dir = fs.mkdtempSync(path.join(os.tmpdir(), "imp-"));
+fs.writeFileSync(path.join(dir, "a.md"), "# Alpha\n\nhello world");
+fs.writeFileSync(path.join(dir, "b.md"), "plain text no heading");
+const r1 = m.importMarkdownFiles([path.join(dir, "a.md"), path.join(dir, "b.md")], path.join(dir, "out"));
+assert(r1[0].ok && r1[0].title === "Alpha", "import a.md -> book 'Alpha'");
+assert(r1[1].ok && r1[1].title === "b", "import b.md -> book 'b'");
+assert(fs.readFileSync(path.join(dir, "a.md"), "utf-8") === "# Alpha\n\nhello world", "original file untouched");
+const r2 = m.importMarkdownFiles([path.join(dir, "a.md")], path.join(dir, "out"));
+assert(r2[0].ok && r2[0].bookPath.endsWith("Alpha 2"), "name collision gets numeric suffix");
+const pj = JSON.parse(fs.readFileSync(path.join(dir, "out", "Alpha", "folio.json"), "utf-8"));
+const entry = pj.chapters[pj.chapterOrder[0]];
+const ch = fs.readFileSync(path.join(dir, "out", "Alpha", entry.file), "utf-8");
+assert(ch.includes("hello world"), "chapter content copied into book");
+const r3 = m.importMarkdownFiles(["/nonexistent/zz.md"], path.join(dir, "out2"));
+assert(!r3[0].ok && r3[0].error, "missing file reports error, no crash");
+
+console.log(fails ? `SMOKE: ${fails} FAILURES` : "SMOKE: ALL PASSED");
+process.exit(fails ? 1 : 0);