ops: persist desktop download feed on /data volume + IT release guide

- docker-compose: DOWNLOADS_DIR=/data/downloads so uploaded installers/latest.yml
  survive image rebuilds (deploy.sh) instead of being wiped.
- DEPLOY.md: step-by-step for publishing a desktop release (build → upload the
  3 feed files → verify) so the Download button + auto-update go live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

DEPLOY.md

@@ -130,6 +130,52 @@ ssh -p 61 root@118.95.33.89 'cd /opt/bizgaze-support && ./deploy.sh'
 
 ---
 
+## Desktop app releases (make the installer live + auto-update)
+
+Web/UI changes reach the desktop app instantly (it loads the live site). Only a change to the
+**native shell** (`desktop/`) needs a new installer. Publishing one both powers the site's
+"Download for Windows" button and pushes an auto-update to already-installed apps.
+
+The installer feed is served from `DOWNLOADS_DIR`, which docker-compose now points at
+`/data/downloads` (the persistent volume) so uploads survive `deploy.sh` rebuilds. **First time
+only**, redeploy once after pulling so the container picks up `DOWNLOADS_DIR`, then create the dir:
+
+```bash
+ssh -p 61 root@118.95.33.89 'docker exec bizgaze-support mkdir -p /data/downloads'
+```
+
+**Each desktop release:**
+
+1. Build on a Windows machine (needs `desktop/build/icon.ico`; bump `desktop/package.json`
+   `version` first):
+   ```bash
+   cd desktop && npm install && npm run dist
+   ```
+   Output in `desktop/dist/`: `Biz Connect Setup <ver>.exe`, `…​.exe.blockmap`, `latest.yml`.
+2. Upload those **three** files into `/data/downloads` on the server (all three are required —
+   `latest.yml` is the update manifest, `.blockmap` enables differential updates):
+   ```bash
+   scp -P 61 "desktop/dist/Biz Connect Setup <ver>.exe" \
+             "desktop/dist/Biz Connect Setup <ver>.exe.blockmap" \
+             "desktop/dist/latest.yml" \
+             root@118.95.33.89:/data/downloads/
+   # if DOWNLOADS_DIR isn't on a host bind-mount, copy into the volume instead:
+   #   docker cp "Biz Connect Setup <ver>.exe" bizgaze-support:/data/downloads/
+   ```
+3. Verify:
+   ```bash
+   curl -I https://remote.bizgaze.com/download/windows      # 302 → the new .exe
+   curl    https://remote.bizgaze.com/downloads/latest.yml  # shows version <ver>
+   ```
+
+Installed apps check the feed on launch and every 6h, download in the background, and update on
+next restart. Keep the `.exe` + `.blockmap` that `latest.yml` references on the server; older
+versions can be pruned. Note: the installer is **not code-signed**, so Windows SmartScreen shows
+an "unknown publisher" warning — supply an EV/OV code-signing cert to remove it (see
+`desktop/PACKAGING.md`).
+
+---
+
 ## Verify
 
 ```bash

docker-compose.yml

@@ -11,6 +11,9 @@ services:
     environment:
       - PORT=8090
       - DB_PATH=/data/data.db
+      # Desktop installers + auto-update feed live on the persistent volume so uploaded
+      # builds survive image rebuilds (a plain image path would be wiped on every deploy).
+      - DOWNLOADS_DIR=/data/downloads
     # Secrets (TURN credentials, SSO_SECRET, BIZGAZE_WEBHOOK_URL, etc.) live in
     # a .env file next to this compose file. It is gitignored — never committed.
     # See .env.example for the expected keys.