feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

test/desktop/port.test.ts

@@ -0,0 +1,97 @@
+/**
+ * test/desktop/port.test.ts — unit tests for pickFreePort (B1).
+ *
+ * Real loopback binds (not mocks) exercise both branches: the preferred port is
+ * free (return it) and the preferred port is occupied (fall back to an OS port).
+ */
+
+import { describe, test, expect } from 'vitest'
+import net from 'node:net'
+import { pickFreePort } from '../../desktop/src/port.js'
+
+const LOOPBACK = '127.0.0.1'
+const MIN_PORT = 1
+const MAX_PORT = 65535
+
+/** Bind a server on 127.0.0.1:0 and resolve with the live server + its OS-assigned port. */
+function occupyEphemeralPort(): Promise<{ server: net.Server; port: number }> {
+  return new Promise((resolve, reject) => {
+    const server = net.createServer()
+    server.on('error', reject)
+    server.listen(0, LOOPBACK, () => {
+      const address = server.address()
+      if (address !== null && typeof address === 'object') resolve({ server, port: address.port })
+      else reject(new Error('no AddressInfo'))
+    })
+  })
+}
+
+function closeServer(server: net.Server): Promise<void> {
+  return new Promise((resolve) => server.close(() => resolve()))
+}
+
+/** Acquire a currently-free port number (bind ephemeral, then release it). */
+async function getFreePort(): Promise<number> {
+  const { server, port } = await occupyEphemeralPort()
+  await closeServer(server)
+  return port
+}
+
+/** Confirm a port can be bound right now, then release it. */
+async function isBindable(port: number): Promise<boolean> {
+  const server = net.createServer()
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.on('error', reject)
+      server.listen(port, LOOPBACK, () => resolve())
+    })
+    await closeServer(server)
+    return true
+  } catch {
+    return false
+  }
+}
+
+describe('pickFreePort', () => {
+  test('returns the preferred port when it is free', async () => {
+    // Arrange
+    const preferred = await getFreePort()
+
+    // Act
+    const result = await pickFreePort(preferred)
+
+    // Assert
+    expect(result).toBe(preferred)
+  })
+
+  test('returns a different, bindable port when the preferred port is occupied', async () => {
+    // Arrange
+    const { server, port: occupied } = await occupyEphemeralPort()
+    try {
+      // Act
+      const result = await pickFreePort(occupied)
+
+      // Assert
+      expect(result).not.toBe(occupied)
+      expect(Number.isInteger(result)).toBe(true)
+      expect(result).toBeGreaterThanOrEqual(MIN_PORT)
+      expect(result).toBeLessThanOrEqual(MAX_PORT)
+      expect(await isBindable(result)).toBe(true)
+    } finally {
+      await closeServer(server)
+    }
+  })
+
+  test('returns an integer within the valid TCP port range', async () => {
+    // Arrange
+    const preferred = await getFreePort()
+
+    // Act
+    const result = await pickFreePort(preferred)
+
+    // Assert
+    expect(Number.isInteger(result)).toBe(true)
+    expect(result).toBeGreaterThanOrEqual(MIN_PORT)
+    expect(result).toBeLessThanOrEqual(MAX_PORT)
+  })
+})