feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/port.ts

@@ -0,0 +1,63 @@
+/**
+ * desktop/src/port.ts — pick a bindable TCP port for the embedded server.
+ *
+ * The backend derives allowedOrigins from the concrete port (config.ts M1), so
+ * the desktop shell must resolve a DEFINITE port BEFORE loadConfig — never hand
+ * loadConfig a PORT=0, or http://127.0.0.1:<port> would fall off the Origin
+ * whitelist. We probe the preferred port on the loopback interface; if it is
+ * taken (EADDRINUSE) we ask the OS for a free one (listen on 0), read it, and
+ * close — so the returned port was confirmed bindable a moment ago.
+ */
+
+import net from 'node:net'
+
+/** Loopback host we probe against — the embedded server always binds here in private mode. */
+const LOOPBACK_HOST = '127.0.0.1'
+/** listen(OS_ASSIGN_PORT) → the kernel picks a free ephemeral port for us. */
+const OS_ASSIGN_PORT = 0
+
+/**
+ * Return `preferred` if it can be bound on 127.0.0.1; otherwise an OS-assigned
+ * free port. A bind failure that is EADDRINUSE falls back to an OS-assigned
+ * port; any other error (e.g. EACCES on a privileged port) is rethrown.
+ */
+export async function pickFreePort(preferred: number): Promise<number> {
+  try {
+    return await tryBind(preferred)
+  } catch (err: unknown) {
+    if (isAddrInUse(err)) return tryBind(OS_ASSIGN_PORT)
+    throw err
+  }
+}
+
+/** Bind a throwaway server on `port` (0 → OS-assigned), read the actual port, close, resolve it. */
+function tryBind(port: number): Promise<number> {
+  return new Promise<number>((resolve, reject) => {
+    const server = net.createServer()
+    server.on('error', (err) => {
+      server.close()
+      reject(err)
+    })
+    server.listen(port, LOOPBACK_HOST, () => {
+      const address = server.address()
+      const bound = address !== null && typeof address === 'object' ? address.port : null
+      server.close(() => {
+        if (bound === null) {
+          reject(new Error('pickFreePort: server.address() did not return an AddressInfo'))
+          return
+        }
+        resolve(bound)
+      })
+    })
+  })
+}
+
+/** True iff `err` is a Node errno error whose code is EADDRINUSE. */
+function isAddrInUse(err: unknown): boolean {
+  return (
+    typeof err === 'object' &&
+    err !== null &&
+    'code' in err &&
+    err.code === 'EADDRINUSE'
+  )
+}