feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/types.ts

@@ -0,0 +1,77 @@
+/**
+ * desktop/src/types.ts — frozen shared contract for the Electron desktop shell.
+ *
+ * This is the single source of truth for cross-module data shapes (mirrors the
+ * backend's src/types.ts role). Modules own disjoint files but all agree here.
+ * All shapes are readonly (immutability — coding-style CRITICAL rule).
+ *
+ * Status/gate string unions are kept in sync with the backend (src/types.ts):
+ *   ClaudeStatus = 'working' | 'waiting' | 'idle' | 'unknown' | 'stuck'
+ *   PermissionGate = 'tool' | 'plan'
+ * They are re-declared (not imported) so the desktop package stays decoupled;
+ * notify-policy references these literals directly.
+ */
+
+/** Host platform (subset of NodeJS.Platform we branch on). */
+export type Platform = 'darwin' | 'win32' | 'linux'
+
+/** Claude activity, mirrored from backend ClaudeStatus (src/types.ts:97). */
+export type DesktopClaudeStatus = 'working' | 'waiting' | 'idle' | 'unknown' | 'stuck'
+
+/** Approval gate kind, mirrored from backend PermissionGate (src/types.ts:101). */
+export type DesktopPermissionGate = 'tool' | 'plan'
+
+/**
+ * User preferences, persisted as JSON in the app's userData dir (hand-rolled
+ * store — matches the project's minimal-deps convention; no electron-store).
+ */
+export interface DesktopPrefs {
+  /** Preferred listen port; null → default (3000, with free-port fallback). */
+  readonly port: number | null
+  /** true → bind 0.0.0.0 (LAN sharing, no auth); false → 127.0.0.1 (private). */
+  readonly lanSharing: boolean
+  /** Shell override; null → platform default (see shell.ts). */
+  readonly shellPath: string | null
+  /** Launch the app on OS login. */
+  readonly openAtLogin: boolean
+  /** Fire a native notification when a session holds a pending approval. */
+  readonly notifyOnApproval: boolean
+  /** Fire a native notification when a session's Claude status changes. */
+  readonly notifyOnStatusChange: boolean
+}
+
+/** Handle returned by the embedded server, for lifecycle + window wiring. */
+export interface EmbeddedServer {
+  /** The concrete port the server bound to (already free-checked). */
+  readonly port: number
+  /** The host it bound to ('0.0.0.0' or '127.0.0.1'). */
+  readonly bindHost: string
+  /** Origins the server will accept (derived by the backend from port + NICs). */
+  readonly allowedOrigins: readonly string[]
+  /** Graceful shutdown: closes HTTP + WS and kills all PTYs. */
+  close(): Promise<void>
+}
+
+/** A single session's status snapshot, fed to the notification policy. */
+export interface SessionStatusSnapshot {
+  readonly sessionId: string
+  readonly claudeStatus: DesktopClaudeStatus
+  readonly pendingApproval: boolean
+  /** Gate kind when an approval is held (for a richer notification body). */
+  readonly gate: DesktopPermissionGate | null
+  /** Human label for the session (folder/process), if known. */
+  readonly title: string | undefined
+}
+
+/** The decision produced by notify-policy for one status transition. */
+export interface NotifyDecision {
+  readonly notify: boolean
+  readonly title: string
+  readonly body: string
+}
+
+/** Parsed `terminalapp://` deep link. */
+export interface DeepLink {
+  /** Session id to join (from terminalapp://join/<id>). */
+  readonly join: string
+}