feat: NSIS installer — single signed setup.exe with Start Menu + Desktop shortcuts

- Installs to Program Files\Wraith\
- Creates Start Menu and Desktop shortcuts
- Registers uninstaller in Add/Remove Programs
- Installer itself is EV code-signed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-release.yml

@@ -55,7 +55,7 @@ jobs:
             mingw-w64 mingw-w64-tools binutils-mingw-w64 \
             cmake ninja-build nasm meson \
             default-jre-headless \
-            python3 curl pkg-config
+            python3 curl pkg-config nsis
 
           # Node.js 22 — Tailwind CSS v4 and Naive UI require Node >= 20
           NODE_MAJOR=$(node --version 2>/dev/null | sed 's/v\([0-9]*\).*/\1/' || echo "0")
@@ -303,6 +303,94 @@ jobs:
           echo "=== version.json ==="
           cat dist/version.json
 
+      # ===============================================================
+      # NSIS Installer
+      # ===============================================================
+      - name: Build NSIS installer
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+
+          cat > /tmp/wraith-installer.nsi << 'NSIEOF'
+          !include "MUI2.nsh"
+
+          Name "Wraith"
+          OutFile "wraith-setup.exe"
+          InstallDir "$PROGRAMFILES64\Wraith"
+          InstallDirRegKey HKLM "Software\Wraith" "InstallDir"
+          RequestExecutionLevel admin
+
+          !define MUI_ICON "${NSISDIR}\Contrib\Graphics\Icons\modern-install.ico"
+
+          !insertmacro MUI_PAGE_DIRECTORY
+          !insertmacro MUI_PAGE_INSTFILES
+          !insertmacro MUI_LANGUAGE "English"
+
+          Section "Install"
+            SetOutPath "$INSTDIR"
+            File "wraith.exe"
+            File "*.dll"
+            File "version.json"
+
+            ; Start Menu shortcut
+            CreateDirectory "$SMPROGRAMS\Wraith"
+            CreateShortcut "$SMPROGRAMS\Wraith\Wraith.lnk" "$INSTDIR\wraith.exe"
+            CreateShortcut "$DESKTOP\Wraith.lnk" "$INSTDIR\wraith.exe"
+
+            ; Uninstaller
+            WriteUninstaller "$INSTDIR\uninstall.exe"
+
+            ; Registry
+            WriteRegStr HKLM "Software\Wraith" "InstallDir" "$INSTDIR"
+            WriteRegStr HKLM "Software\Wraith" "Version" "${VERSION}"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "DisplayName" "Wraith"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "UninstallString" "$INSTDIR\uninstall.exe"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "DisplayVersion" "${VERSION}"
+            WriteRegStr HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith" "Publisher" "Vantz Stockwell"
+          SectionEnd
+
+          Section "Uninstall"
+            Delete "$INSTDIR\wraith.exe"
+            Delete "$INSTDIR\*.dll"
+            Delete "$INSTDIR\version.json"
+            Delete "$INSTDIR\uninstall.exe"
+            RMDir "$INSTDIR"
+            Delete "$SMPROGRAMS\Wraith\Wraith.lnk"
+            RMDir "$SMPROGRAMS\Wraith"
+            Delete "$DESKTOP\Wraith.lnk"
+            DeleteRegKey HKLM "Software\Wraith"
+            DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Wraith"
+          SectionEnd
+          NSIEOF
+
+          # Replace VERSION placeholder
+          sed -i "s/\${VERSION}/${VERSION}/g" /tmp/wraith-installer.nsi
+
+          # Build installer from the dist directory
+          cd dist
+          makensis -DVERSION="${VERSION}" /tmp/wraith-installer.nsi
+          mv wraith-setup.exe ../wraith-${VERSION}-setup.exe
+          cd ..
+
+          echo "=== Installer built ==="
+          ls -la wraith-${VERSION}-setup.exe
+
+      - name: Sign installer
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          echo "=== Signing installer ==="
+          java -jar /usr/local/bin/jsign.jar \
+            --storetype AZUREKEYVAULT \
+            --keystore "${{ secrets.AZURE_KEY_VAULT_URL }}" \
+            --storepass "${{ steps.azure-token.outputs.token }}" \
+            --alias "${{ secrets.AZURE_CERT_NAME }}" \
+            --tsaurl http://timestamp.digicert.com \
+            --tsmode RFC3161 \
+            wraith-${VERSION}-setup.exe
+          echo "Installer signed."
+
+          # Move to dist for upload
+          mv wraith-${VERSION}-setup.exe dist/
+
       # ===============================================================
       # Upload to Gitea Package Registry
       # ===============================================================