feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/deep-link.ts

@@ -0,0 +1,73 @@
+/**
+ * desktop/src/deep-link.ts — B2: terminalapp:// deep-link parsing.
+ *
+ * Maps the OS custom-protocol URL `terminalapp://join/<id>` onto the existing
+ * frontend's `/?join=<id>` route (see DESKTOP_PLAN §4.3). Pure + hand-validated
+ * (no URL-parsing surprises): the URL class does the heavy lifting inside a
+ * try/catch so a malformed link yields null instead of throwing at the boundary.
+ */
+
+import type { DeepLink } from './types.js'
+
+/** Custom protocol registered with the OS (electron app.setAsDefaultProtocolClient). */
+export const DEEP_LINK_PROTOCOL = 'terminalapp'
+
+/** The single legal host segment: terminalapp://join/<id>. */
+const JOIN_HOST = 'join'
+
+/** URL.protocol includes the trailing colon, so compare against that form. */
+const PROTOCOL_WITH_COLON = `${DEEP_LINK_PROTOCOL}:`
+
+/**
+ * Parse `terminalapp://join/<id>` into a DeepLink, or null if it is not a
+ * well-formed join link. Rejects: wrong scheme, wrong host, missing/empty id,
+ * ids with '/' or control chars, and anything the URL parser chokes on.
+ */
+export function parseDeepLink(url: string): DeepLink | null {
+  let parsed: URL
+  try {
+    parsed = new URL(url)
+  } catch {
+    return null
+  }
+
+  if (parsed.protocol !== PROTOCOL_WITH_COLON) return null
+  if (parsed.host !== JOIN_HOST) return null
+
+  // pathname is '/<id>' for a single segment; strip the leading slash and require
+  // exactly one non-empty segment (no nested paths like join/a/b).
+  const rawPath = parsed.pathname.replace(/^\/+/, '')
+  if (rawPath === '' || rawPath.includes('/')) return null
+
+  const id = safeDecode(rawPath)
+  if (id === null) return null
+  if (!isValidId(id)) return null
+
+  return { join: id }
+}
+
+/** Render a DeepLink as the frontend query-route the window navigates to. */
+export function deepLinkToPath(link: DeepLink): string {
+  return `/?join=${encodeURIComponent(link.join)}`
+}
+
+/** decodeURIComponent can throw on malformed percent-encoding — narrow to null. */
+function safeDecode(value: string): string | null {
+  try {
+    return decodeURIComponent(value)
+  } catch {
+    return null
+  }
+}
+
+/** An id is valid if it is non-empty, not whitespace-only, and control-char free. */
+function isValidId(id: string): boolean {
+  if (id.trim() === '') return false
+  if (id.includes('/')) return false
+  // Reject C0/C1 control characters (they can't be part of a real session id).
+  for (const ch of id) {
+    const code = ch.charCodeAt(0)
+    if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) return false
+  }
+  return true
+}