Configure desktop update feed

Desktop/docs/windows-update-feed.md

@@ -0,0 +1,47 @@
+# Windows Update Feed
+
+QSfera Desktop uses the built-in Windows updater from `src/gui/updater`.
+The updater reads `APPLICATION_UPDATE_URL`, appends query parameters such as
+`version`, `platform=win32`, and `msi=true`, and expects an XML document with
+root element `QSfera`.
+
+Production feed URL:
+
+```text
+https://qsfera.kusoft.xyz/desktop/updates/stable.xml
+```
+
+The no-update feed is valid when no signed Windows MSI is available yet:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<QSfera>
+  <version></version>
+  <versionstring></versionstring>
+  <web>https://qsfera.kusoft.xyz/</web>
+  <downloadurl></downloadurl>
+</QSfera>
+```
+
+To advertise a signed MSI update, publish the MSI over HTTPS and replace the
+feed with a concrete version:
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<QSfera>
+  <version>1.3.7</version>
+  <versionstring>1.3.7</versionstring>
+  <web>https://qsfera.kusoft.xyz/</web>
+  <downloadurl>https://qsfera.kusoft.xyz/desktop/downloads/QSfera_Desktop-1.3.7-x64.msi</downloadurl>
+</QSfera>
+```
+
+Validate the live feed before a Windows production release:
+
+```powershell
+./scripts/validate-desktop-update-feed.ps1 -Url "https://qsfera.kusoft.xyz/desktop/updates/stable.xml"
+./scripts/validate-production-release.ps1 -VerifyUpdateFeed
+```
+
+For a stable signed tag release, `validate-production-release.ps1 -RequireSigning`
+also verifies this live feed.