feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

desktop/src/window.ts

@@ -0,0 +1,54 @@
+/**
+ * desktop/src/window.ts — creates the single BrowserWindow that hosts the
+ * unchanged web frontend, loaded from the embedded localhost server.
+ *
+ * Hardening (DESKTOP_PLAN §8 / TECH_DOC §7): contextIsolation on, nodeIntegration
+ * off, sandbox on, preload restricted to a minimal contextBridge. Because the
+ * only page ever loaded is the trusted embedded http://127.0.0.1:<port> origin,
+ * we deny every new-window request and block navigation to any foreign origin —
+ * a defence-in-depth guard against a hijacked page trying to escape localhost.
+ */
+import { BrowserWindow } from 'electron'
+
+const WINDOW_WIDTH = 1100
+const WINDOW_HEIGHT = 720
+const BACKGROUND_COLOR = '#0e0f13'
+
+/** Parse the origin of a URL, returning null for anything malformed. */
+function originOf(url: string): string | null {
+  try {
+    return new URL(url).origin
+  } catch {
+    return null
+  }
+}
+
+export function createMainWindow(url: string, preloadPath: string): BrowserWindow {
+  const win = new BrowserWindow({
+    width: WINDOW_WIDTH,
+    height: WINDOW_HEIGHT,
+    backgroundColor: BACKGROUND_COLOR,
+    webPreferences: {
+      contextIsolation: true,
+      nodeIntegration: false,
+      sandbox: true,
+      preload: preloadPath,
+    },
+  })
+
+  const allowedOrigin = originOf(url)
+
+  // Never spawn child windows; the frontend has no legitimate reason to.
+  win.webContents.setWindowOpenHandler(() => ({ action: 'deny' }))
+
+  // Block navigation away from the embedded localhost origin.
+  win.webContents.on('will-navigate', (event, targetUrl) => {
+    if (allowedOrigin === null) return
+    if (originOf(targetUrl) !== allowedOrigin) {
+      event.preventDefault()
+    }
+  })
+
+  void win.loadURL(url)
+  return win
+}