setup: the installer is our own window — the alpha key is the gate, the release comes down with it and is verified before the silent install, and the in-app tour asks for the key too

setup/src-tauri/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "soulstream-setup"
+version.workspace = true
+description = "SoulStream Setup — the installer testers run: our own window, the alpha key as the gate, the real installer downloaded from the private release and verified"
+authors.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+
+# One file to hand out: SoulStream-Setup.exe. Not bundled — it IS the bundle.
+[[bin]]
+name = "SoulStream-Setup"
+path = "src/main.rs"
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+serde_json.workspace = true
+
+[dependencies]
+tauri = { version = "2", features = [] }
+serde.workspace = true
+serde_json.workspace = true
+# The alpha key goes where the app reads it: the Credential Manager.
+keyring = { version = "3", features = ["windows-native"] }
+dirs = "5"
+rfd = "0.15"
+winreg = "0.52"
+# The release comes down from GitHub with the key, and its signature is
+# checked against the same public key the app's updater trusts.
+reqwest = { version = "0.12", features = ["json"] }
+minisign-verify = "0.2"
+base64 = "0.21"