feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/server-config.ts

@@ -0,0 +1,43 @@
+/**
+ * desktop/src/server-config.ts — build the env overrides fed to the backend's
+ * loadConfig() for the embedded server.
+ *
+ * Starts from a COPY of the ambient env (never mutates it) and pins the four
+ * values the desktop shell controls: PORT (the free port we already resolved),
+ * BIND_HOST (private 127.0.0.1 by default; 0.0.0.0 only when LAN sharing is on),
+ * SHELL_PATH (platform-aware default so Windows gets PowerShell), and USE_TMUX
+ * (forced off on Windows — tmux is a *nix keepalive; elsewhere respect the
+ * ambient env, defaulting off). Every other ambient var passes through untouched.
+ */
+
+import type { DesktopPrefs } from './types.js'
+import { defaultShellForPlatform } from './shell.js'
+
+/** Loopback bind host — private mode; the window connects here and always passes Origin checks. */
+const PRIVATE_BIND_HOST = '127.0.0.1'
+/** Wildcard bind host — LAN sharing (phones/tablets reconnect); opt-in, no auth. */
+const LAN_BIND_HOST = '0.0.0.0'
+/** tmux keepalive is a *nix feature; the desktop shell defaults it off (and forces off on Windows). */
+const TMUX_OFF = '0'
+
+export interface ServerEnvInput {
+  readonly prefs: DesktopPrefs
+  readonly port: number
+  readonly platform: NodeJS.Platform
+  readonly env: NodeJS.ProcessEnv
+}
+
+/**
+ * Produce the env-override object for loadConfig(). Immutable: input.env is
+ * spread into a NEW object and is never mutated.
+ */
+export function buildServerEnv(input: ServerEnvInput): Record<string, string | undefined> {
+  const { prefs, port, platform, env } = input
+  return {
+    ...env,
+    PORT: String(port),
+    BIND_HOST: prefs.lanSharing ? LAN_BIND_HOST : PRIVATE_BIND_HOST,
+    SHELL_PATH: prefs.shellPath ?? defaultShellForPlatform(platform, env),
+    USE_TMUX: platform === 'win32' ? TMUX_OFF : (env.USE_TMUX ?? TMUX_OFF),
+  }
+}