Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

packaging/systemd/tanin-aur-update.service

@@ -1,13 +1,25 @@
 [Unit]
 Description=TANINUX [tanin] repo — daily AUR rebuild
-Documentation=file:%h/projects/taninux/packaging/aur-autoupdate.sh
+Documentation=file:%h/taninux/packaging/aur-autoupdate.sh
 After=network-online.target
 Wants=network-online.target
 
 [Service]
 Type=oneshot
-# Adjust the path if your checkout lives elsewhere.
-ExecStart=%h/projects/taninux/packaging/aur-autoupdate.sh run
+# Dedicated, locked build account (see setup-build-user.sh) — NOT the human
+# "karim" account. Isolates the root-equivalent makechrootpkg/arch-nspawn/
+# mkarchroot sudo grant (tanin-aur-update.sudoers) off the personal login.
+User=tanin-build
+Group=tanin-build
+# %h now resolves against tanin-build's home (/var/lib/tanin-build by
+# setup-build-user.sh), NOT /home/karim — so this checkout must live there
+# too (setup-build-user.sh clones/syncs it in). Adjust if it lives elsewhere.
+ExecStart=%h/taninux/packaging/aur-autoupdate.sh run
+# The packager signing key: GPGKEY must be set, and GNUPGHOME (default
+# %h/.gnupg = /var/lib/tanin-build/.gnupg) must actually contain that secret
+# key for tanin-build — see gen-signing-key.sh + setup-build-user.sh.
+# Environment=GPGKEY=<packager key fingerprint, from gen-signing-key.sh>
+# Environment=GNUPGHOME=%h/.gnupg   # only needed if it's not already the default
 # Be a good citizen — this is a background rebuild, not interactive work.
 Nice=15
 IOSchedulingClass=idle