Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

packaging/aur-autoupdate.sh

@@ -20,6 +20,14 @@
 #   TANIN_CHROOT      clean chroot location      (default ~/.cache/tanin-chroot)
 #   TANIN_AUR_CACHE   AUR clone + state cache    (default ~/.cache/tanin-aur)
 #   TANIN_PUBLISH_CMD upload hook, e.g. an rsync (default empty = local only)
+#   GPGKEY            packager key fingerprint (REQUIRED — see gen-signing-key.sh)
+#
+# All the above default under $HOME, which under the shipped systemd service
+# (User=tanin-build) resolves to /var/lib/tanin-build — so the dedicated build
+# user gets its own repo/chroot/cache, isolated from the human account. The
+# signing key must be reachable by that same user: either its GNUPGHOME
+# (default ~/.gnupg, i.e. /var/lib/tanin-build/.gnupg under the service) holds
+# the packager secret key, or GNUPGHOME is pointed at wherever it lives.
 set -uo pipefail
 
 REPO_NAME="tanin"
@@ -28,6 +36,7 @@ DB="$OUT/$REPO_NAME.db.tar.zst"
 CHROOT="${TANIN_CHROOT:-$HOME/.cache/tanin-chroot}"
 CACHE="${TANIN_AUR_CACHE:-$HOME/.cache/tanin-aur}"
 PUBLISH="${TANIN_PUBLISH_CMD:-}"
+GPGKEY="${GPGKEY:-}"
 
 # AUR-only deps of TANINUX (not in the official repos). Mirrors the list in
 # finish-tanin-repo.sh — keep them in sync.
@@ -36,6 +45,13 @@ AUR_PKGS=(eww-git tiramisu-git waypaper calamares librewolf-bin
 
 log() { printf '[%s] %s\n' "$REPO_NAME-aur" "$*"; }
 
+# makechrootpkg builds inside an isolated chroot with no access to the host's
+# GPG agent/keyring, so packages are signed here on the host, right after
+# they're copied out of the chroot into $OUT — not with makepkg --sign inside it.
+sign_pkg() {
+  gpg --batch --yes --detach-sign --use-agent -u "$GPGKEY" "$1"
+}
+
 # --- one-time setup --------------------------------------------------------
 setup() {
   sudo pacman -S --needed --noconfirm devtools git jq curl
@@ -96,7 +112,11 @@ build_one() {
   rm -f "$dir"/*.pkg.tar.zst
   # -c = clean copy of the chroot each time; -r = which chroot; -- = makepkg args
   if ( cd "$dir" && makechrootpkg -c -r "$CHROOT" -- --noconfirm ); then
-    cp "$dir"/*.pkg.tar.zst "$OUT"/ && log "   ok: $p"
+    cp "$dir"/*.pkg.tar.zst "$OUT"/ || { log "   COPY FAILED: $p"; return 1; }
+    for f in "$dir"/*.pkg.tar.zst; do
+      sign_pkg "$OUT/$(basename "$f")" || { log "   SIGN FAILED: $p"; return 1; }
+    done
+    log "   ok: $p (signed)"
     built_version "$dir" > "$CACHE/$p.ver" 2>/dev/null || true
     return 0
   fi
@@ -106,6 +126,13 @@ build_one() {
 
 run() {
   [ -d "$CHROOT/root" ] || { log "no chroot — run '$0 setup' first"; exit 1; }
+  # Fail closed: never build/publish unsigned packages.
+  if [ -z "$GPGKEY" ]; then
+    log "GPGKEY is not set — refusing to build unsigned packages."
+    log "Run packaging/gen-signing-key.sh once (if you haven't), then set GPGKEY"
+    log "(e.g. Environment=GPGKEY=<fingerprint> in tanin-aur-update.service)."
+    exit 1
+  fi
   mkdir -p "$OUT" "$CACHE"
   local built=0 failed=0
   for p in "${AUR_PKGS[@]}"; do
@@ -113,8 +140,8 @@ run() {
   done
 
   if [ "$built" -gt 0 ]; then
-    log "refreshing DB ($built rebuilt)"
-    repo-add -q "$DB" "$OUT"/*.pkg.tar.zst >/dev/null
+    log "refreshing DB ($built rebuilt, signed with $GPGKEY)"
+    repo-add -s -k "$GPGKEY" -q "$DB" "$OUT"/*.pkg.tar.zst >/dev/null
     # keep only the newest file per package on disk
     command -v paccache >/dev/null && paccache -rq -k1 -c "$OUT" >/dev/null 2>&1 || true
     if [ -n "$PUBLISH" ]; then