feat: add safe Gitea sync and signed updates

preload.cjs

@@ -46,7 +46,7 @@ contextBridge.exposeInMainWorld(
     applyUpdate: () => invoke('updates:apply'),
     saveServer: (server, password = '', passphrase = '') => invoke('server:save', { server, password, passphrase }),
     deleteServer: (serverId) => invoke('server:delete', { serverId }),
-    testServer: (serverId) => invoke('server:test', { serverId }),
+    testServer: (serverId, expectedFingerprint = '') => invoke('server:test', { serverId, expectedFingerprint }),
     inspectServerProject: (repository, profileId) => invoke('server:inspect-project', { repository, profileId }),
     discoverExistingDeployment: (repository, serverId, remoteFolder) =>
       invoke('server:discover-existing', {
@@ -97,6 +97,8 @@ contextBridge.exposeInMainWorld(
     repairGitLocks: (localPath, force = false) => invoke('repository:repair-git-locks', { localPath, force }),
     reconcileRepository: (localPath) => invoke('repository:reconcile', { localPath }),
     repairRepositorySync: (localPath, strategy) => invoke('repository:repair-sync', { localPath, strategy }),
+    previewWorkspaceSync: (localPath) => invoke('repository:workspace-sync-preview', { localPath }),
+    applyWorkspaceSync: (localPath, expectedPlanId) => invoke('repository:workspace-sync-apply', { localPath, expectedPlanId }),
     setOrigin: (localPath, remoteUrl) => invoke('repository:set-origin', { localPath, remoteUrl }),
     normalizeOrigins: () => invoke('repositories:normalize-origins'),
     cloneRepository: (fullName, mode = 'default') => invoke('repository:clone', { fullName, mode }),