release 1.3.2: update from Gitea, Linux-only CLI, desktop app for Linux and Windows

The updater reads latest.json from Gitea, built by scripts/make-latest-json.py
against the Gitea API (no gh CLI). Release workflow builds the Linux CLI and
the Linux+Windows desktop app, signs the updater artifacts and attaches
everything to the release.

Needs the repo secrets TAURI_SIGNING_PRIVATE_KEY and
TAURI_SIGNING_PRIVATE_KEY_PASSWORD, which I could not set (secret-store writes
are reserved for the user) - set them from ~/.tauri/guara-updater.key and
.pass before pushing a tag.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/gui/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Guara",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "identifier": "dev.guara.app",
   "build": {
     "frontendDist": "../ui"
@@ -41,7 +41,7 @@
     "updater": {
       "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDhENzRCRUU5NEI3QTAxQzgKUldUSUFYcEw2YjUwamFzMnpXM3ZKTEZPN1JIeXdLL3Q5SEF1M1FxQ284WFM0UWNsdlAyNUloWTEK",
       "endpoints": [
-        "https://github.com/lucasrguerra/guara/releases/latest/download/latest.json"
+        "https://git.lucasrguerra.dev.br/lucasrguerra/guara/releases/latest/download/latest.json"
       ],
       "windows": {
         "installMode": "passive"