setup, updater: the installer window was a dev build with nothing inside it, and latest never matched a prerelease

Tauri decides dev-vs-production from the `custom-protocol` feature, not from
--release, and both workflows build the setup exe with a plain `cargo build`.
So cfg(dev) stayed on, the frontend was never embedded, and the window a
tester opened loaded devUrl: "localhost refused to connect" on a blank
800x580. The feature is a default of the crate now, with a build.rs guard
that fails a release build without it, and build.rs tracks setup/dist so a
changed window cannot be left out of the binary it is supposed to be in.

Behind that, the next wall: /releases/latest answers only with full
releases, and every release here is an alpha, so it 404s. The setup app read
that as a refused key and the app's Stable channel read it as a token that
cannot see the repository — both have been broken since the first alpha.
Each now lists /releases and takes the newest that is neither a draft nor
the rolling nightly, which the list really does put first.

And check_saved_key threw the saved key away on any failure at all, a
dropped connection included. The entry it deletes is the app's own updater
token, so only a refusal clears it now.

The release notes name the file to hand a tester: six assets on the page and
nothing saying which, while the bare NSIS installer is the biggest of them
and installs with no key gate and no signature check.

src-tauri/src/updater.rs

@@ -11,8 +11,12 @@
 //! private release cannot be read without a token. With a read-only token
 //! saved in the Credential Manager (Settings → Updates → Access token), a
 //! GitHub source is resolved through the API instead of the browser URLs:
-//! `GET /repos/{o}/{r}/releases/latest` (or `/tags/{tag}`) finds the
-//! `latest.json` asset, the plugin fetches THAT asset URL with
+//! `GET /repos/{o}/{r}/releases/tags/{tag}` for a pinned tag, and for
+//! `latest` a `GET /repos/{o}/{r}/releases` whose first entry that is
+//! neither a draft nor the rolling `nightly` wins. NOT `/releases/latest`:
+//! that answers only with full releases, and every release here is an
+//! alpha, so it 404s. Either way the `latest.json` asset is found, the
+//! plugin fetches THAT asset URL with
 //! `Authorization: Bearer` + `Accept: application/octet-stream`, and the
 //! manifest's own download URLs are API asset URLs too — the workflows
 //! rewrite them after publishing — so the installer downloads with the same
@@ -37,6 +41,8 @@ pub const DEFAULT_STABLE: &str =
     "https://github.com/KeelrLeek/SoulStream/releases/latest/download/latest.json";
 pub const DEFAULT_NIGHTLY: &str =
     "https://github.com/KeelrLeek/SoulStream/releases/download/nightly/latest.json";
+/// The tag `nightly.yml` rewrites daily. Never what `latest` should resolve to.
+const NIGHTLY_TAG: &str = "nightly";
 
 /// First automatic check after launch, then the interval between checks.
 const FIRST_CHECK: Duration = Duration::from_secs(25);
@@ -199,22 +205,15 @@ fn announce(app: &AppHandle) {
     let _ = app.emit("updater:status", status(app));
 }
 
-/// Ask the GitHub API where a private release keeps its `latest.json`.
-async fn resolve_github_asset(
-    src: &GitHubSource,
+/// One authenticated GitHub API GET, its failures already in words.
+async fn github_json(
+    client: &reqwest::Client,
+    url: &str,
     token: &str,
     user_agent: &str,
-) -> Result<Url, String> {
-    let api = format!(
-        "https://api.github.com/repos/{}/{}/releases/{}",
-        src.owner, src.repo, src.release
-    );
-    let client = reqwest::Client::builder()
-        .timeout(Duration::from_secs(30))
-        .build()
-        .map_err(|e| e.to_string())?;
+) -> Result<serde_json::Value, String> {
     let resp = client
-        .get(&api)
+        .get(url)
         .header(reqwest::header::AUTHORIZATION, format!("Bearer {token}"))
         .header(reqwest::header::ACCEPT, "application/vnd.github+json")
         .header(reqwest::header::USER_AGENT, user_agent)
@@ -229,7 +228,47 @@ async fn resolve_github_asset(
         404 => return Err("no release found — or the token cannot see the repository".into()),
         s => return Err(format!("GitHub answered {s}")),
     }
-    let body: serde_json::Value = resp.json().await.map_err(|e| e.to_string())?;
+    resp.json().await.map_err(|e| e.to_string())
+}
+
+/// Ask the GitHub API where a private release keeps its `latest.json`.
+async fn resolve_github_asset(
+    src: &GitHubSource,
+    token: &str,
+    user_agent: &str,
+) -> Result<Url, String> {
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(30))
+        .build()
+        .map_err(|e| e.to_string())?;
+    let repo = format!("https://api.github.com/repos/{}/{}", src.owner, src.repo);
+    let body = if src.release == "latest" {
+        // `/releases/latest` answers with the newest FULL release, and every
+        // SoulStream release so far is a prerelease — so it 404s and Stable
+        // reports the token cannot see the repository. The list comes newest
+        // first: take the first that is neither a draft nor the rolling
+        // nightly, which the Nightly channel asks for by tag instead.
+        let list = github_json(&client, &format!("{repo}/releases?per_page=30"), token, user_agent)
+            .await?;
+        list.as_array()
+            .and_then(|rs| {
+                rs.iter()
+                    .find(|r| {
+                        r["draft"].as_bool() != Some(true)
+                            && r["tag_name"].as_str() != Some(NIGHTLY_TAG)
+                    })
+                    .cloned()
+            })
+            .ok_or("no release found — or the token cannot see the repository")?
+    } else {
+        github_json(
+            &client,
+            &format!("{repo}/releases/{}", src.release),
+            token,
+            user_agent,
+        )
+        .await?
+    };
     let assets = body["assets"].as_array().cloned().unwrap_or_default();
     let asset = assets
         .iter()