fix(updater): mount UpdateToast outside auth gates

apps/desktop/src/App.tsx

@@ -1,6 +1,7 @@
 import { BrowserRouter, Navigate, Route, Routes } from 'react-router-dom';
 
 import { AppShell } from './components/AppShell';
+import { UpdateToast } from './components/UpdateToast';
 import { RequireAdmin, RequireAuth, RequireDevice } from './components/guards';
 import { AuthProvider } from './context/AuthContext';
 import { CallProvider } from './context/CallContext';
@@ -44,6 +45,7 @@ export function App() {
               </Route>
               <Route path="*" element={<Navigate to="/chats" replace />} />
             </Routes>
+            <UpdateToast />
             </BrowserRouter>
           </CallProvider>
         </ConversationsProvider>

apps/desktop/src/components/AppShell.tsx

@@ -4,7 +4,6 @@ import { Outlet } from 'react-router-dom';
 import { ensureNotificationPermission } from '../lib/osNotify';
 import { CallUI } from './CallUI';
 import { Sidebar } from './Sidebar';
-import { UpdateToast } from './UpdateToast';
 
 export function AppShell() {
   useEffect(() => {
@@ -25,7 +24,6 @@ export function AppShell() {
         </main>
       </div>
       <CallUI />
-      <UpdateToast />
     </div>
   );
 }