docs(desktop): updates are admin-only — keep the polkit prompt; AppImage rejected on field evidence

Decision (user, 2026-09-04) after the first successful self-update
(v0.1.6 → v0.1.7): a .deb update runs pkexec dpkg -i and asks for an admin
password the operator does not have — that prompt is the intended gate.
The AppImage was tried as the no-root path and aborts on the 26.04 booth
(bundled 24.04 glib/WebKitGTK vs host gvfs/Mesa: EGL_BAD_PARAMETER), and it
discards the distro-maintained WebKitGTK the platform decision rests on.
Passwordless polkit for dpkg is root for the operator — rejected.

- update.prompt (en + sq) now says the install needs the administrator
  password.
- desktop-shell-tauri.md: decision, evidence, rejected alternatives, and the
  deferred fleet-grade option (root systemd timer in the .deb, minisign-
  verified, notify-only in-app).
- standing-decisions.md: ship the .deb; runtime backend; updates admin-only.
- appliance-provisioning.md: drop the stale "hardcoded to localhost" note.

Claude-Session: https://claude.ai/code/session_01FWncR69HgGPuei1dLrW3cU

apps/web/src/lib/i18n/sq.ts

@@ -61,7 +61,7 @@ export const sq = {
   },
   update: {
     available: "Përditësim i disponueshëm",
-    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis?",
+    prompt: "Versioni {{version}} është i disponueshëm. Ta instaloj tani dhe ta rinis? (Instalimi kërkon fjalëkalimin e administratorit.)",
   },
   nav: {
     booth: "Kabina",