feat: trusted-domains OAuth popups, og:image bookmark posters, periodic updater

- main.js: trusted-domains list with default Google/Yandex/GitHub/etc.;
  cross-domain confirmation skipped for trusted; setWindowOpenHandler
  returns action:'allow' for trusted so OAuth popups work (postMessage
  back to opener, popup self-closes). Fixes YouTube/Google login reset.
- main.js: get-page-meta IPC extracts og:image / twitter:image / JSON-LD
  image from current view; HDRezka also tries .b-sidecover img for hi-res.
- Header: bookmark button pulls og:image as poster and the page's title;
  duplicate detection switched from hostname to full URL so multiple
  movies from same site can coexist.
- BookmarksBar: site icon rendered next to source domain when distinct
  from poster; img onerror falls back to placeholder.
- Settings: trusted domains chip list with add/remove/reset.
- Updater: proper semver compare (only show if latest > current),
  direct installer URL detection per platform, hourly re-check.

Bookmark schema gains optional siteIcon; existing bookmarks remain valid.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/pages/HomePage.tsx

@@ -64,8 +64,18 @@ const HomePage: React.FC = () => {
     setActiveApp('movie-search')
   }
 
-  const handleBookmarkAdd = (title: string, url: string, poster: string, source: string) => {
-    const updated = [...bookmarks, { title, url, poster, source }]
+  const handleBookmarkAdd = (title: string, url: string, poster: string, source: string, siteIcon?: string) => {
+    // If caller didn't pass a site icon (e.g. movie search), look it up from the apps config by host.
+    let icon = siteIcon || ''
+    if (!icon) {
+      try {
+        const host = new URL(url).hostname
+        const match = appCardList.find(a => { try { return new URL(a.url).hostname === host } catch { return false } })
+        if (match?.imageUrl) icon = match.imageUrl
+      } catch {}
+    }
+    const sourceStr = source || (() => { try { return new URL(url).hostname.replace(/^www\./, '') } catch { return '' } })()
+    const updated = [...bookmarks, { title, url, poster, source: sourceStr, siteIcon: icon }]
     setBookmarks(updated)
     configRef.current = { ...configRef.current, bookmarks: updated }
     window.electron?.writeConfig(configRef.current)