Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

iso/overrides/airootfs/etc/pacman.conf

@@ -1,6 +1,8 @@
 # pacman.conf for the LIVE system and (via unpackfs) the installed target.
-# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
-# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
+# [tanin]'s packager key is imported + locally signed into the keyring by
+# customize_airootfs.sh, so Required DatabaseOptional (every package must
+# carry a valid signature from a trusted key; the DB signature itself is
+# optional) verifies cleanly here.
 [options]
 HoldPkg     = pacman glibc
 Architecture = auto
@@ -21,5 +23,5 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [tanin]
-SigLevel = Optional TrustAll
+SigLevel = Required DatabaseOptional
 Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch