feat: add remote announcements and release candidate fixes

[Horuse]

What does this PR do?

• adds remotely managed announcements that can be shown as banners, modals, or both without publishing a new app build;
• filters announcements by semantic version range, release channel, platform, architecture, expiry time, priority, severity, and local dismissal state;
• validates remote announcement payloads, rejects duplicate IDs, supports refreshed notices through updatedAt, and opens announcement actions through the system browser;
• includes debug triggers and matcher/payload tests for announcement banners, modal queues, dismissal, and targeting;
• makes cached application information reactive so About and updater UI no longer temporarily display v?;
• prevents a closed VST3 editor from reopening when the running pipeline is reconciled after graph changes;
• fixes Waveform sizing so an unconnected monitor starts with one channel, its XYFlow node/resizer grows with the connected channel layout, and each lane remains readable;
• keeps the live buffer-limit notice exclusive to the waveform embedded in File Recording;
• disables webview devtools/context-menu access in release configuration; and
• bumps the application and changelog to 1.3.0-rc.1.

Why is this the right approach?

Announcements are fetched from a repository-owned JSON file, so urgent release notices and targeted RC feedback requests can be changed independently of the application release cycle. Matching and payload validation remain local and deterministic, while dismissed IDs are stored in localStorage. Modal announcements reuse the existing modal manager and are processed sequentially, avoiding overlapping dialogs.

The semver dependency is used because prerelease ranges and channel-aware targeting are easy to implement incorrectly with custom string parsing. @types/semver provides its TypeScript declarations, and bun-types provides the test/runtime globals required by the Bun test file and Node globals used by the Vite configuration.

Waveform sizing is synchronized through XYFlow's node state instead of relying only on CSS. This keeps the visible node, resize outline, handles, and persisted dimensions aligned. The minimum canvas height is one 22 px time scale plus 72 px per displayed channel, while user-added height is preserved as channels are added or removed.

The VST3 reconcile fix checks whether the existing editor window is still visible before reattaching the recreated plugin instance. A deliberately closed window therefore remains closed, while an open editor survives a compatible pipeline rebuild.

Checklist

• Diff is limited to the release-candidate fixes and announcement feature
• bun run check passes
• cargo check --manifest-path src-tauri/Cargo.toml passes
• bun run format leaves the tree clean
• Generated TS types are committed with the Rust change (not applicable; no #[derive(TS)] type changed)
• New dependencies are explained in the PR description
• I read the RT audio path section of docs/CONCEPT.md and confirmed this change adds no allocations, locks, or syscalls to cpal / SCK callbacks or DspWorker::run

Platform coverage

• Developed on: macOS (Apple Silicon)
• Tested on: macOS
• What I did to test:
  • ran bun run check;
  • ran cargo check --manifest-path src-tauri/Cargo.toml;
  • ran bun test tests/announcements_matcher.test.ts (15 passing tests);
  • ran bun run format and confirmed it produced no changes;
  • exercised announcement banners, critical modals, sequential modal handling, and dismissal through the debug panel;
  • verified Waveform rendering and XYFlow resizing with one and multiple connected channels.
• Not tested: Linux, Windows

The only per-OS files changed are src-tauri/tauri.macos.conf.json, src-tauri/tauri.linux.conf.json, and src-tauri/tauri.windows.conf.json; each receives the same devtools: false webview setting. No platform-specific audio backend was changed.