Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

packaging/build-tanin-repo.sh

@@ -16,6 +16,17 @@ DB="$OUT/tanin.db.tar.zst"
 LOGDIR="$OUT/logs"
 mkdir -p "$OUT" "$LOGDIR"
 
+# Fail closed: never build/publish unsigned packages. Run packaging/gen-signing-key.sh
+# once, then `export GPGKEY=<fingerprint>` (or put it in your shell rc) before building.
+GPGKEY="${GPGKEY:-}"
+if [ -z "$GPGKEY" ]; then
+  echo "!! GPGKEY is not set — refusing to build unsigned packages." >&2
+  echo "   Run packaging/gen-signing-key.sh once (if you haven't), then:" >&2
+  echo "     export GPGKEY=<packager key fingerprint>" >&2
+  exit 1
+fi
+export GPGKEY
+
 # tanin-icons builds from the installed Adwaita theme -> needs librsvg + python.
 OWN_SIMPLE=(tanin-greet tanin-libadwaita tanin-setup tanin-eww tanin-icons tanin-desktop)
 OWN_BUILD=(taninux)
@@ -27,7 +38,7 @@ AUR_REBUILD=(eww-git tiramisu-git waypaper calamares librewolf-bin
 build() {
   local p="$1" log="$LOGDIR/$p.log"
   echo "==> building $p (log: $log)"
-  ( cd "$HERE/$p" && makepkg -d -f --noconfirm ) >"$log" 2>&1 \
+  ( cd "$HERE/$p" && makepkg -d -f --sign --noconfirm ) >"$log" 2>&1 \
     && cp "$HERE/$p/"*.pkg.tar.zst "$OUT/" 2>/dev/null \
     && echo "   ok" || { echo "   FAILED ($p) — see $log"; return 1; }
 }
@@ -46,11 +57,12 @@ echo "** build logs (incl. makepkg warnings) in: $LOGDIR"
 echo "** AUR rebuilds TODO (not in official repos): ${AUR_REBUILD[*]}"
 echo "   build each with paru/makepkg and copy the .pkg.tar.zst into $OUT, then re-run."
 
-# refresh the DB (unsigned for now -> pacman.conf: SigLevel = Optional TrustAll)
+# refresh the DB — packages are signed above (makepkg --sign, key=$GPGKEY);
+# sign the DB too so pacman.conf can require Required DatabaseOptional.
 shopt -s nullglob
 pkgs=("$OUT"/*.pkg.tar.zst)
 if (( ${#pkgs[@]} )); then
-  ( cd "$OUT" && repo-add -q "$DB" ./*.pkg.tar.zst >/dev/null 2>&1 )
+  ( cd "$OUT" && repo-add -s -k "$GPGKEY" -q "$DB" ./*.pkg.tar.zst >/dev/null 2>&1 )
   echo "== [tanin] repo refreshed at $OUT =="
   ls -1 "$OUT" | grep -E '\.pkg\.tar\.zst$|tanin\.db'
 else