feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/electron-builder.yml

@@ -0,0 +1,64 @@
+# electron-builder config for the web-terminal desktop shell (Mac focus).
+#
+# PACKAGING MODEL — server + its node_modules on disk (extraResources), NOT in asar:
+#   The embedded server (src/server.ts) is ESM, resolves the frontend via
+#   path.join(__dirname,'..','public'), and imports express/ws/web-push/node-pty.
+#   embedded-server.ts loads it from process.resourcesPath when packaged. So we ship,
+#   as real files under Contents/Resources (siblings): dist/ + public/ + node_modules/.
+#   The server then resolves `require('express')` etc. via a plain Node walk-up to
+#   Resources/node_modules — no asar, no ESM-from-asar, no native-module-in-asar issues.
+#   (An earlier build shipped only node-pty and "worked" in-place only because it borrowed
+#    the repo's node_modules up the tree; from /Applications that failed with
+#    "Cannot find package 'express'". This ships the full runtime dep tree.)
+#
+#   node_modules is filtered to drop build-only tooling (electron/electron-builder/esbuild/
+#   typescript + their heavy binaries) — never the server's runtime deps or their transitives.
+#   node-pty is rebuilt for the Electron ABI (npmRebuild) before the copy.
+#
+# App icon: auto-generated from resources/icon.png. Tray icon: shipped in-asar under assets/.
+# NOTE: Windows packaging needs a Windows machine (no wine here).
+appId: com.webterminal.desktop
+productName: Web Terminal
+directories:
+  output: dist-app
+  buildResources: resources
+files:
+  - build/**/*
+  - assets/**/*
+  - package.json
+extraMetadata:
+  main: build/main.cjs
+extraResources:
+  - from: ../dist
+    to: dist
+  - from: ../public
+    to: public
+    filter:
+      - "**/*"
+      - "!**/*.ts"
+      - "!**/*.map"
+  - from: node_modules
+    to: node_modules
+    filter:
+      - "**/*"
+      # build-only tooling — never needed at runtime by express/ws/web-push/node-pty:
+      - "!electron/**"
+      - "!electron-builder/**"
+      - "!esbuild/**"
+      - "!@esbuild/**"
+      - "!typescript/**"
+      - "!app-builder-bin/**"
+      - "!dmg-builder/**"
+      - "!7zip-bin/**"
+      - "!@electron/**"
+      - "!@develar/**"
+# Rebuild native deps (node-pty) against the Electron ABI before packaging + copy.
+npmRebuild: true
+mac:
+  target:
+    - dmg
+    - zip
+  category: public.app-category.developer-tools
+win:
+  target:
+    - nsis