feat(client): Windows 提供 Inno Setup 安装程序 + 下载改同源 HTTPS

- Windows 客户端打成 jiu-windows-x64-setup.exe（Inno Setup，中文向导、
  桌面/开始菜单快捷方式、卸载项），替代解压版 zip
- provision-windows.sh 自动静默安装 Inno Setup（缺则装）
- 下载 URL 从内网 HTTP Forgejo 改为 https://jiu.51yanmei.com/downloads/，
  修复 HTTPS 页面下发 http 内网地址被浏览器拦截（无法安全下载），win/mac 均生效
- deploy.sh 将安装包发布到 EC2 /opt/jiu/downloads/，nginx 新增 /downloads/ 路由

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/ci/release.sh

@@ -44,9 +44,13 @@ notes = sys.argv[2]
 tag   = sys.argv[3]
 furl  = sys.argv[4].rstrip('/')
 repo  = sys.argv[5]
-base  = f"{furl}/{repo}/releases/download/{tag}"
+# Public download URLs are served by jiu.51yanmei.com (same-origin HTTPS via the
+# pangolin nginx /downloads/ location), NOT the LAN-only HTTP Forgejo instance —
+# otherwise the HTTPS download page hands the browser an http://192.168.x URL and
+# Chrome blocks it as insecure / it's unreachable from the public internet.
+base  = "https://jiu.51yanmei.com/downloads"
 mac_url = f"{base}/jiu-macos-x64.zip"
-win_url = f"{base}/jiu-windows-x64.zip"
+win_url = f"{base}/jiu-windows-x64-setup.exe"
 
 lines = []
 with open('backend/config/version.yaml') as f:
@@ -128,6 +132,6 @@ upload_asset dist/web.tar.gz
 upload_asset dist/marketing.tar.gz
 upload_asset dist/configs.tar.gz
 upload_asset dist/jiu-macos-x64.zip
-upload_asset dist/jiu-windows-x64.zip
+upload_asset dist/jiu-windows-x64-setup.exe
 
 echo "==> release: done — Release ${TAG} created"