fix(desktop): mirror server runtime deps + drop dangling .bin from bundle

Two fixes required to repackage the macOS app after the split-grid frontend landed:

- The bundled node_modules is copied from desktop/node_modules, which only mirrored
  4 of the 6 server runtime deps. google-auth-library (imported at server startup by
  dist/push/fcm.js) and qrcode were missing, so the embedded server crashed on launch
  ("Cannot find package 'google-auth-library'"). Added both to desktop/package.json so
  they're installed + bundled. (The old build predated the FCM code, hiding this.)
- electron-builder died with "ENOENT .bin/asar": node_modules/.bin holds dev-tool
  symlinks (asar/tsc/esbuild) into packages the filter excludes, leaving dangling
  symlinks in the bundle that electron-builder stat()s. Excluded .bin/** from the copy
  (runtime deps load by path, not via .bin).

Verified: dist:mac builds clean (signed, DMG), installed to /Applications, embedded
server serves :3000 (HTTP 200) and the split-grid frontend loads.

desktop/package.json

@@ -20,7 +20,9 @@
   },
   "dependencies": {
     "express": "^5.2.1",
+    "google-auth-library": "^10.9.0",
     "node-pty": "^1.1.0",
+    "qrcode": "^1.5.4",
     "web-push": "3.6.7",
     "ws": "^8.21.0"
   },