Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

packaging/gen-signing-key.sh

@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+# Generate the TANINUX packager signing key — THE DISTRO'S ROOT OF TRUST.
+#
+# Run this ONCE, by the maintainer, on a trusted machine. The resulting key
+# signs every [tanin] package (makepkg --sign) and the repo DB (repo-add -s);
+# every user who runs `pacman-key --lsign-key <fingerprint>` is trusting this
+# key to vouch for everything TANINUX ships. Guard the private key + its
+# passphrase like the root of the distro, because that's what it is.
+#
+#   ./gen-signing-key.sh                          # prompts for Name-Email + a
+#                                                  # gpg-agent passphrase prompt
+#   NAME_EMAIL=pkg@taninux.example ./gen-signing-key.sh
+#
+# This script does NOT set GPGKEY / wire it into the build scripts — that's a
+# manual step below, so a compromised shell env can't silently point the
+# build at the wrong key.
+set -euo pipefail
+
+command -v gpg >/dev/null || { echo "!! gpg not found" >&2; exit 1; }
+
+NAME_REAL="TANINUX Packager"
+NAME_EMAIL="${NAME_EMAIL:-}"
+EXPIRE="${EXPIRE:-2y}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+if [ -z "$NAME_EMAIL" ]; then
+  read -rp "Packager key Name-Email (placeholder, doesn't need to receive mail): " NAME_EMAIL
+fi
+[ -n "$NAME_EMAIL" ] || { echo "!! Name-Email is required" >&2; exit 1; }
+
+echo "== generating: $NAME_REAL <$NAME_EMAIL>  (Ed25519, expires in $EXPIRE) =="
+echo "   gpg will prompt (via pinentry/gpg-agent) for a passphrase — set a real one."
+
+PARAMFILE="$(mktemp)"
+trap 'rm -f "$PARAMFILE"' EXIT
+cat > "$PARAMFILE" <<EOF
+%ask-passphrase
+Key-Type: eddsa
+Key-Curve: ed25519
+Key-Usage: sign
+Name-Real: $NAME_REAL
+Name-Email: $NAME_EMAIL
+Expire-Date: $EXPIRE
+%commit
+EOF
+
+gpg --batch --gen-key "$PARAMFILE"
+
+FPR="$(gpg --list-keys --with-colons "$NAME_EMAIL" 2>/dev/null \
+  | awk -F: '/^fpr:/ { print $10; exit }')"
+
+if [ -z "$FPR" ]; then
+  echo "!! key created but the fingerprint could not be auto-detected." >&2
+  echo "   run: gpg --list-keys \"$NAME_EMAIL\"" >&2
+  exit 1
+fi
+
+cat <<EOT
+
+============================================================
+ TANINUX packager key created
+ Fingerprint: $FPR
+============================================================
+
+Next steps (manual — nothing below runs automatically):
+
+  1) Export the PUBLIC key into the target keyring source, so
+     customize_airootfs.sh's \`pacman-key --add\` picks it up on the next ISO
+     build. Re-export replaces/updates the file (see the comment left in
+     customize_airootfs.sh for the matching --lsign-key line to add):
+       gpg --export "$FPR" > "$ROOT/iso/overrides/airootfs/etc/pacman.d/tanin-repo.gpg"
+       gpg --export "$FPR" > "$ROOT/iso/build-profile/airootfs/etc/pacman.d/tanin-repo.gpg"
+
+  2) Publish the public key for existing/new users to import (see the
+     Cutover section in docs/distribution.md), e.g.:
+       gpg --export "$FPR" > /path/to/served/tanin-repo.gpg
+     and record "$FPR" in docs/distribution.md's Cutover section.
+
+  3) Point the build scripts at it (build-tanin-repo.sh, finish-tanin-repo.sh,
+     aur-autoupdate.sh all read GPGKEY from the environment and refuse to
+     build unsigned if it's unset):
+       export GPGKEY="$FPR"
+     For the systemd-driven daily rebuild (packaging/systemd/tanin-aur-update.service,
+     running as the dedicated tanin-build user — see setup-build-user.sh),
+     set Environment=GPGKEY=$FPR in the unit, or an EnvironmentFile it reads,
+     and make sure GNUPGHOME for tanin-build actually holds this secret key.
+
+  4) BACK UP THE PRIVATE KEY (\`gpg --export-secret-keys $FPR\`) to an offline,
+     encrypted location. Losing it means re-keying the whole distro and
+     asking every user to re-import; leaking it means anyone can sign
+     packages TANINUX users will install as trusted.
+EOT