fix(desktop): mirror server runtime deps + drop dangling .bin from bundle

Two fixes required to repackage the macOS app after the split-grid frontend landed:

- The bundled node_modules is copied from desktop/node_modules, which only mirrored
  4 of the 6 server runtime deps. google-auth-library (imported at server startup by
  dist/push/fcm.js) and qrcode were missing, so the embedded server crashed on launch
  ("Cannot find package 'google-auth-library'"). Added both to desktop/package.json so
  they're installed + bundled. (The old build predated the FCM code, hiding this.)
- electron-builder died with "ENOENT .bin/asar": node_modules/.bin holds dev-tool
  symlinks (asar/tsc/esbuild) into packages the filter excludes, leaving dangling
  symlinks in the bundle that electron-builder stat()s. Excluded .bin/** from the copy
  (runtime deps load by path, not via .bin).

Verified: dist:mac builds clean (signed, DMG), installed to /Applications, embedded
server serves :3000 (HTTP 200) and the split-grid frontend loads.

desktop/electron-builder.yml

@@ -41,6 +41,10 @@ extraResources:
     to: node_modules
     filter:
       - "**/*"
+      # .bin holds dev-tool shims (asar/tsc/esbuild/…) symlinked into packages we
+      # exclude below — copying them leaves DANGLING symlinks that electron-builder
+      # stat()s and dies on (ENOENT .bin/asar). Runtime deps load by path, not .bin.
+      - "!.bin/**"
       # build-only tooling — never needed at runtime by express/ws/web-push/node-pty:
       - "!electron/**"
       - "!electron-builder/**"