Display arrangement persistence + centering fix, packaging hardening

- core/display.py: write_positions() persists Arrangement's drag-and-drop
  layout into niri's config.kdl (one output { position x= y= } per output),
  validated via `niri validate` on a temp copy with a .kdl.bak backup before
  writing — same pattern as core/keybindings.py's rebind(). Previously the
  page only ever called `niri msg output … position set`, which niri treats
  as live-only and drops on the next login/reload.
- gui/pages/display.py: Arrangement's Apply now runs each output's `niri msg
  output … position set` synchronously instead of queuing them all on the
  single-shot ProcessRunner (which rejects a second run() while the first is
  still async) — a 2-monitor apply previously moved only the first output
  and silently dropped the rest. _dock_to_nearest keeps the free axis at the
  dragged position (so a shorter display can sit vertically centered next to
  a taller rotated one) rather than forcing corner alignment.
- core/panel.py, files/__init__.py: incidental fixes alongside the above.
- packaging/: signing-key generation script + build-user systemd setup for
  the [tanin] AUR auto-rebuild pipeline; PKGBUILD bumped to pkgrel=5.
- src/taninux/browser/: new module for browser theme sync (Fuji accent).

packaging/finish-tanin-repo.sh

@@ -11,9 +11,20 @@ HERE="$(cd "$(dirname "$0")" && pwd)"
 OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
 mkdir -p "$OUT"
 
+# Fail closed: never build/publish unsigned packages. Run packaging/gen-signing-key.sh
+# once, then `export GPGKEY=<fingerprint>` before running this script.
+GPGKEY="${GPGKEY:-}"
+if [ -z "$GPGKEY" ]; then
+  echo "!! GPGKEY is not set — refusing to build unsigned packages." >&2
+  echo "   Run packaging/gen-signing-key.sh once (if you haven't), then:" >&2
+  echo "     export GPGKEY=<packager key fingerprint>" >&2
+  exit 1
+fi
+export GPGKEY
+
 echo "==> taninux (+ build deps)"
 sudo pacman -S --needed --noconfirm python-build python-installer python-hatchling
-( cd "$HERE/taninux" && makepkg -sf --noconfirm ) \
+( cd "$HERE/taninux" && makepkg -sf --sign --noconfirm ) \
   && cp "$HERE/taninux/"*.pkg.tar.zst "$OUT/" && echo "   ok" || echo "   FAILED (taninux)"
 
 AUR_PKGS="eww-git tiramisu-git waypaper calamares librewolf-bin arch-update timeshift-autosnap xdg-terminal-exec paru"
@@ -22,7 +33,7 @@ tmp="$(mktemp -d)"
 for p in $AUR_PKGS; do
   echo "  -- $p"
   if git clone --depth=1 "https://aur.archlinux.org/$p.git" "$tmp/$p" >/dev/null 2>&1 \
-     && ( cd "$tmp/$p" && makepkg -sf --noconfirm ); then
+     && ( cd "$tmp/$p" && makepkg -sf --sign --noconfirm ); then
     cp "$tmp/$p/"*.pkg.tar.zst "$OUT/" && echo "     ok"
   else
     echo "     FAILED ($p)"
@@ -30,8 +41,8 @@ for p in $AUR_PKGS; do
 done
 rm -rf "$tmp"
 
-echo "==> refresh DB"
-( cd "$OUT" && repo-add -q "$OUT/tanin.db.tar.zst" "$OUT"/*.pkg.tar.zst )
+echo "==> refresh DB (signed with $GPGKEY)"
+( cd "$OUT" && repo-add -s -k "$GPGKEY" -q "$OUT/tanin.db.tar.zst" "$OUT"/*.pkg.tar.zst )
 echo "== [tanin] now contains =="
 ls -1 "$OUT" | grep -E '\.pkg\.tar\.zst$|tanin\.db$'
 echo