feat(client): Windows 提供 Inno Setup 安装程序 + 下载改同源 HTTPS

- Windows 客户端打成 jiu-windows-x64-setup.exe（Inno Setup，中文向导、
  桌面/开始菜单快捷方式、卸载项），替代解压版 zip
- provision-windows.sh 自动静默安装 Inno Setup（缺则装）
- 下载 URL 从内网 HTTP Forgejo 改为 https://jiu.51yanmei.com/downloads/，
  修复 HTTPS 页面下发 http 内网地址被浏览器拦截（无法安全下载），win/mac 均生效
- deploy.sh 将安装包发布到 EC2 /opt/jiu/downloads/，nginx 新增 /downloads/ 路由

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci/deploy.sh

@@ -90,6 +90,11 @@ rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no
 rsync -avz --delete -e "ssh -i ~/.ssh/ec2_deploy.pem -o StrictHostKeyChecking=no" \
   /tmp/jiu-marketing-new/ "${EC2_USER}@${EC2_HOST}:/tmp/jiu-marketing-new/"
 
+# Upload desktop client installers (served from /downloads/ by nginx).
+# Guarded: may be absent in a partial manual deploy.
+[ -f dist/jiu-windows-x64-setup.exe ] && ${SCP} dist/jiu-windows-x64-setup.exe "${EC2_USER}@${EC2_HOST}:/tmp/jiu-windows-x64-setup.exe" || true
+[ -f dist/jiu-macos-x64.zip ] && ${SCP} dist/jiu-macos-x64.zip "${EC2_USER}@${EC2_HOST}:/tmp/jiu-macos-x64.zip" || true
+
 echo "==> deploy: running remote deploy"
 
 ${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
@@ -126,6 +131,11 @@ mkdir -p /opt/jiu/marketing
 rsync -a --delete /tmp/jiu-marketing-new/ /opt/jiu/marketing/
 rm -rf /tmp/jiu-marketing-new
 
+# Publish desktop client installers to the nginx-served downloads dir
+mkdir -p /opt/jiu/downloads
+[ -f /tmp/jiu-windows-x64-setup.exe ] && mv -f /tmp/jiu-windows-x64-setup.exe /opt/jiu/downloads/ || true
+[ -f /tmp/jiu-macos-x64.zip ] && mv -f /tmp/jiu-macos-x64.zip /opt/jiu/downloads/ || true
+
 # Update jiu nginx config in the pangolin-edge reverse proxy.
 # nginx now runs inside the `pangolin-edge` container (host networking), not on
 # the host. Its /etc/nginx/conf.d is bind-mounted from the host dir below, so we