feat(desktop): wire up HealthChat auto-update + public installer hosting

The Electron auto-updater (Squirrel.Mac / Squirrel.Windows) was already
implemented but switched off for HealthChat because the variant config
omitted update_base_url, and CI published only installers (no update feed),
to a private GitHub Release that can't serve end users or the updater.

- config.json: set update_base_url to https://healthchat.ch/packages/desktop/update/
  so electron-main starts the updater.
- build-healthchat-desktop.yaml: pass base-url to the macOS job so releases.json
  is generated; extend the release job to stage the update feed + public
  installers and mirror them to healthchat.ch over FTPS (lftp, no-delete to
  preserve prior nupkgs; password via LFTP_PASSWORD).
- Document the feed/install layout, FTP secrets, and the two caveats (first
  install is manual; Windows auto-update needs the Setup.exe path, not .msi)
  in the healthchat README and the releasing-healthchat skill.

Requires repo secrets FTP_SERVER / FTP_USERNAME / FTP_PASSWORD.

.claude/skills/releasing-healthchat/SKILL.md

@@ -18,7 +18,12 @@ Releases are driven by git tags of the form `healthchat-v<semver>` pushed to
   workflows create-if-missing then upload, so they race safely. (Linux is intentionally
   not built — the upstream Linux reusable pulls a build-env Docker image keyed by commit
   SHA that only exists in the upstream element-hq registry, so it cannot succeed in this
-  fork.)
+  fork.) The `release` job additionally **mirrors the Squirrel update feed and the public
+  installers to `https://healthchat.ch/packages/desktop/` over FTPS** (the private GitHub
+  Release can serve neither end users nor the auto-updater). This is what makes installed
+  apps self-update; see `apps/desktop/element.io/healthchat/README` for the feed layout and
+  the two caveats (first install is manual; Windows auto-update needs the Setup.exe path,
+  not the .msi).
 
 Publish target: **ghcr.io Docker image + GitHub Release (web bundle + desktop
 installers).** No npm, no mobile fan-out.
@@ -165,6 +170,11 @@ warning. Prefer fixing the changelog over relying on the fallback.
 - [ ] The desktop workflow run ("Build HealthChat Desktop") is green and the
       GitHub Release has the desktop installers attached (.dmg, *-mac.zip, *.msi,
       "* Setup*.exe").
+- [ ] The update feed + installers published to healthchat.ch: `curl -fsI`
+      `https://healthchat.ch/packages/desktop/update/macos/releases.json`,
+      `.../update/win32/x64/RELEASES`, and the public installer URLs
+      `.../install/macos/HealthChat.dmg` / `.../install/win32/x64/HealthChat-Setup.exe`
+      all return 200.
 - [ ] Smoke-check signing: macOS `spctl -a -vvv -t install <app>` is accepted;
       Windows installer shows a valid publisher (no SmartScreen block).
 
@@ -176,6 +186,7 @@ Configured in repo Settings → Secrets and variables → Actions:
 |---|---|
 | `HEALTHCHAT_WORKSPACE_TOKEN` | PAT with read access to `Novaloop-AG/healthchat-workspace`. Needed by `actions/checkout` for the private plugin repo. |
 | `GITHUB_TOKEN` | Auto-provided. Used for ghcr.io login and GitHub Release creation. No manual setup required. |
+| `FTP_SERVER` / `FTP_USERNAME` / `FTP_PASSWORD` | Credentials for the healthchat.ch FTP(S) account. The desktop `release` job uses them to publish the update feed + public installers under `/public_html/healthchat.ch/packages/desktop/`. `FTP_SERVER` is the hostname only (explicit FTPS / AUTH TLS). Without them the FTP publish step fails (but the GitHub Release still gets the installers). |
 
 Desktop signing additionally requires two GitHub **environments** (Settings →
 Environments). Without them the desktop builds still run but produce