feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/build.mjs

@@ -0,0 +1,24 @@
+/**
+ * desktop/build.mjs — bundle the Electron main + preload with esbuild.
+ *
+ * Source is ESM TypeScript (desktop/src/*.ts); output is CJS (.cjs) so Electron
+ * loads it as the main/preload entry regardless of package "type". `electron`
+ * and `node-pty` are marked external (provided by the Electron runtime / loaded
+ * as a native addon at runtime, never bundled). The compiled server under
+ * ../dist is loaded via a runtime dynamic import (a computed specifier), so
+ * esbuild leaves it external automatically.
+ */
+import { build } from 'esbuild'
+
+const shared = {
+  bundle: true,
+  platform: 'node',
+  target: 'node20',
+  format: 'cjs',
+  sourcemap: true,
+  logLevel: 'info',
+  external: ['electron', 'node-pty'],
+}
+
+await build({ ...shared, entryPoints: ['src/main.ts'], outfile: 'build/main.cjs' })
+await build({ ...shared, entryPoints: ['src/preload.ts'], outfile: 'build/preload.cjs' })