feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

test/desktop/live-poll.test.ts

@@ -0,0 +1,134 @@
+/**
+ * test/desktop/live-poll.test.ts — B2: mapLiveSessions boundary validation.
+ */
+
+import { describe, test, expect } from 'vitest'
+import { mapLiveSessions } from '../../desktop/src/live-poll.js'
+
+describe('mapLiveSessions', () => {
+  test('returns [] when the body is not an array', () => {
+    expect(mapLiveSessions(null)).toEqual([])
+    expect(mapLiveSessions(undefined)).toEqual([])
+    expect(mapLiveSessions({})).toEqual([])
+    expect(mapLiveSessions('nope')).toEqual([])
+    expect(mapLiveSessions(42)).toEqual([])
+  })
+
+  test('maps a well-formed element to a snapshot', () => {
+    // Arrange
+    const raw = [
+      { id: 'sess-1', status: 'waiting', cwd: '/Users/me/projects/web-terminal', exited: false },
+    ]
+
+    // Act
+    const result = mapLiveSessions(raw)
+
+    // Assert
+    expect(result).toEqual([
+      {
+        sessionId: 'sess-1',
+        claudeStatus: 'waiting',
+        pendingApproval: false,
+        gate: null,
+        title: 'web-terminal',
+      },
+    ])
+  })
+
+  test('accepts every valid status literal', () => {
+    const raw = [
+      { id: 'a', status: 'working', cwd: null },
+      { id: 'b', status: 'waiting', cwd: null },
+      { id: 'c', status: 'idle', cwd: null },
+      { id: 'd', status: 'unknown', cwd: null },
+      { id: 'e', status: 'stuck', cwd: null },
+    ]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result.map((s) => s.claudeStatus)).toEqual([
+      'working',
+      'waiting',
+      'idle',
+      'unknown',
+      'stuck',
+    ])
+  })
+
+  test('filters out elements missing a string id', () => {
+    const raw = [
+      { status: 'idle', cwd: null },
+      { id: 42, status: 'idle', cwd: null },
+      { id: '', status: 'idle', cwd: null },
+      { id: 'ok', status: 'idle', cwd: null },
+    ]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result).toHaveLength(1)
+    expect(result[0].sessionId).toBe('ok')
+  })
+
+  test('filters out elements with an invalid or missing status', () => {
+    const raw = [
+      { id: 'a', status: 'busy', cwd: null },
+      { id: 'b', status: 42, cwd: null },
+      { id: 'c', cwd: null },
+      { id: 'd', status: 'idle', cwd: null },
+    ]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result.map((s) => s.sessionId)).toEqual(['d'])
+  })
+
+  test('derives the title from the last cwd path segment', () => {
+    const raw = [{ id: 'a', status: 'idle', cwd: '/Users/me/projects/foo/' }]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result[0].title).toBe('foo')
+  })
+
+  test('derives the title from a Windows backslash cwd', () => {
+    const raw = [{ id: 'a', status: 'idle', cwd: 'C:\\Users\\me\\projects\\foo' }]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result[0].title).toBe('foo')
+  })
+
+  test('filters out already-exited sessions', () => {
+    const raw = [
+      { id: 'live', status: 'waiting', cwd: null, exited: false },
+      { id: 'dead', status: 'waiting', cwd: null, exited: true },
+    ]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result.map((s) => s.sessionId)).toEqual(['live'])
+  })
+
+  test('leaves title undefined when cwd is null or blank', () => {
+    const raw = [
+      { id: 'a', status: 'idle', cwd: null },
+      { id: 'b', status: 'idle', cwd: '' },
+      { id: 'c', status: 'idle' },
+    ]
+
+    const result = mapLiveSessions(raw)
+
+    expect(result.map((s) => s.title)).toEqual([undefined, undefined, undefined])
+  })
+
+  test('never throws on garbage array elements', () => {
+    const raw = [null, undefined, 42, 'str', [], { id: 'ok', status: 'idle', cwd: null }]
+
+    // Act
+    const act = (): unknown => mapLiveSessions(raw)
+
+    // Assert
+    expect(act).not.toThrow()
+    expect(mapLiveSessions(raw)).toHaveLength(1)
+  })
+})