Rewrite quick entry, reports and settings; add installer and self-update

The quick window now asks one thing — the time — and works the rest out:
which seder it belongs to, whether אוהבי ה׳ is possible, and the departure
(the end of the seder, since the window has no departure field by design).
Beside it, dialogs for a justified lateness and for a missed seder; along the
bottom, כולל ערב and תורתו בידו minutes and the month's figures. A normal day
never needs the full app. The field takes 0915, 915, 9.15 or 09:15, an
"אתמול" toggle covers whoever forgot on the way in, and any saved row loads
back into the field for correction.

PDF export was failing outright: the report was rasterized with html2canvas,
which throws on any colour it cannot parse, and Tailwind 4 writes every colour
as oklch(). Reports are now written as real text (src/lib/pdf-doc.ts) with
Heebo embedded and a bidi pass of their own (src/lib/rtl-text.ts) — selectable,
searchable Hebrew, tables that break between rows, page numbers. Heebo is
shipped with the app instead of fetched from Google, so the UI and the
documents use one font and both work offline.

Also:

- First-run wizard opens on the seder hours, the one thing the app cannot
  guess, then notification channels; the name and goal screens are gone.
- History shows one month at a time, with arrows and a month list.
- Statistics and insights were two screens showing the same four figures; now
  one, opening with a sentence rather than a bare score, and reading the
  arrival habit and week-on-week change out of the data.
- Settings: ten sections to eight, duplicated settings merged, two sections
  that changed nothing removed. The audit log is gone; in its place a log file
  Rust owns (%APPDATA%\SederPlus\logs) that Settings shows.
- Versions are whole numbers from 1. Pushing to main publishes the next one
  with the installer attached, taking the number from the tags so a release
  cannot trigger another.
- SederPlusSetup.exe: both programs, per-user, no questions and no UAC — which
  is what lets "update now" download, install and restart quietly.
- Removed what was left of the previous build: the Supabase config and key,
  bun.lock, the localStorage archive pass, html2canvas, settings that drove
  nothing. Net 500 lines lighter, with 130 more tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Yehuda-Zakesh

.env

@@ -1,8 +1,11 @@
+# Checks for anything that is not a push to main.
+#
+# A push to main goes through .github/workflows/release.yml instead, which runs
+# these same three checks against the version-stamped tree before it publishes
+# anything — so running them here as well would only duplicate the work.
 name: CI (typecheck + tests)
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
   workflow_dispatch: {}
@@ -19,8 +22,6 @@ jobs:
         with:
           node-version: 22
 
-      # See the note in build-windows.yml — switch back to `npm ci` once the
-      # refreshed package-lock.json is committed.
       - name: Install dependencies
         run: npm install
 
@@ -30,7 +31,7 @@ jobs:
       - name: Run unit tests
         run: npm test
 
-      # Catches a broken frontend build before the (much slower) Windows EXE
+      # Catches a broken frontend build before the (much slower) release
       # workflow gets that far.
       - name: Build frontend
         run: npm run build

.github/workflows/build-windows.yml

@@ -0,0 +1,126 @@
+# A new version on every push to main.
+#
+# The version number is a whole number and comes from the tags, not from a file
+# in the repository: the newest `vN` tag decides, and this workflow publishes
+# N+1. Nothing is ever committed back to main, so a release cannot trigger
+# another release, and there is no version line for two branches to conflict
+# over.
+#
+# What ends up on the release:
+#   SederPlusSetup.exe    the installer — both programs, silent, per-user
+#   SederPlus.exe         the full app, for anyone who prefers no installer
+#   SederPlusQuick.exe    the quick-entry window
+#
+# The in-app updater looks for the setup file by name (pickInstaller in
+# src/lib/updater.ts), so keep it attached and keep the name.
+
+name: Release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "src-tauri/**"
+      - "public/**"
+      - "installer/**"
+      - "index.html"
+      - "scripts/**"
+      - "package.json"
+      - "package-lock.json"
+      - "vite.config.ts"
+      - ".github/workflows/release.yml"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version number to publish (blank = next after the newest tag)"
+        required: false
+        type: string
+
+permissions:
+  contents: write # to create the tag and the release
+
+concurrency:
+  # Two pushes in quick succession must not both try to publish the same
+  # number; the later one wins and the earlier is cancelled.
+  group: release
+  cancel-in-progress: true
+
+jobs:
+  release:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # tags are how the version is decided
+
+      - name: Work out the version number
+        id: version
+        shell: pwsh
+        run: |
+          $requested = "${{ inputs.version }}"
+          if ($requested -match '^\d+$') {
+            $next = [int]$requested
+          } else {
+            # Highest existing vN tag, ignoring anything that is not just a
+            # number — an old v1.0.3-style tag must not become 104.
+            $numbers = @(git tag --list 'v*' |
+              ForEach-Object { if ($_ -match '^v(\d+)$') { [int]$Matches[1] } })
+            $latest = if ($numbers.Count -gt 0) { ($numbers | Measure-Object -Maximum).Maximum } else { 0 }
+            $next = $latest + 1
+          }
+          "number=$next" >> $env:GITHUB_OUTPUT
+          "tag=v$next" >> $env:GITHUB_OUTPUT
+          Write-Host "Publishing version $next"
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      # Rust builds are the slow part; without a cache every run recompiles
+      # Tauri and its whole dependency tree.
+      - name: Cache Rust build
+        uses: swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Stamp the version
+        run: node scripts/set-version.mjs ${{ steps.version.outputs.number }}
+
+      # A release that fails to start is worse than no release, so the same
+      # checks CI runs happen here too, against the stamped tree.
+      - name: Typecheck
+        run: npx tsc --noEmit -p tsconfig.json
+
+      - name: Frontend tests
+        run: npm test
+
+      - name: Rust tests
+        run: cargo test --manifest-path src-tauri/core/Cargo.toml
+
+      - name: Build both EXEs
+        run: npm run exe
+
+      - name: Build the installer
+        run: npm run installer
+
+      - name: Publish the release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          name: גרסה ${{ steps.version.outputs.number }}
+          target_commitish: ${{ github.sha }}
+          generate_release_notes: true
+          files: |
+            release-win/SederPlusSetup.exe
+            release-win/SederPlus.exe
+            release-win/SederPlusQuick.exe
+          fail_on_unmatched_files: true

.github/workflows/ci.yml

@@ -9,6 +9,9 @@ node_modules
 dist
 *.local
 
+# TanStack Router plugin scratch output
+.tanstack
+
 # Rust / Tauri build output — this gets very large
 src-tauri/target
 src-tauri/*/gen