Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

iso/build-profile/pacman.conf

@@ -1,8 +1,6 @@
 # Build-time pacman.conf for mkarchiso (pulls live packages incl. tanin-desktop).
 # Replaces releng's pacman.conf. [tanin] is added so the airootfs can include
-# our packages. SigLevel=Never on [tanin] keeps the BUILD simple (no keyring
-# bootstrap during mkarchiso); the LIVE/target keyring trusts the key properly
-# (see airootfs/etc/pacman.conf + customize_airootfs.sh).
+# our packages.
 [options]
 HoldPkg     = pacman glibc
 Architecture = auto
@@ -21,5 +19,11 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [tanin]
-SigLevel = Never
+# Required DatabaseOptional assumes packaging/gen-signing-key.sh has been run
+# and its packager pubkey is already trusted on THIS build host's own pacman
+# keyring (mkarchiso's pacstrap reads the host's /etc/pacman.d/gnupg, not the
+# airootfs's — that trust is set up separately by customize_airootfs.sh for
+# the live/target system). Until the key exists and is trusted here, building
+# will fail closed rather than pull unsigned [tanin] packages into the ISO.
+SigLevel = Required DatabaseOptional
 Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch