feat(desktop): Electron all-in-one desktop shell (Mac/Windows) embedding the server

Add a `desktop/` Electron app that embeds the existing Node server + node-pty
(all-in-one): the window loads http://127.0.0.1:<port>/ and reuses the frontend
unchanged; other LAN devices can still connect. The server needs zero changes —
startServer(cfg)/loadConfig already support programmatic embedding.

- Pure, unit-tested modules: port, shell, server-config, deep-link, notify-policy,
  notifications, live-poll, prefs, settings-store (94 tests; desktop/src ~97% cov)
- Electron glue: main/window/tray/menu/preload/embedded-server/logger
  (hardened: contextIsolation, sandbox, deny foreign-origin navigation)
- Native value: OS notifications driven by /live-sessions status, tray, deep links
- Packaging (electron-builder -> arm64 .dmg): ships dist/ + public/ + node_modules
  on-disk under Resources so the server resolves its deps from /Applications;
  node-pty rebuilt for the Electron ABI
- Docs: docs/DESKTOP_PLAN.md; PROGRESS_LOG updated

Verified: desktop tsc clean; 1401 tests pass; coverage >=80% (desktop/src 97/95/100/97);
.dmg built and launch-tested on arm64 (server boots, UI serves 200, node-pty loads).

test/desktop/shell.test.ts

@@ -0,0 +1,39 @@
+/**
+ * test/desktop/shell.test.ts — unit tests for defaultShellForPlatform (B1).
+ *
+ * Covers every platform branch, with and without env.SHELL set.
+ */
+
+import { describe, test, expect } from 'vitest'
+import { defaultShellForPlatform } from '../../desktop/src/shell.js'
+
+describe('defaultShellForPlatform', () => {
+  test('returns powershell.exe on win32 regardless of env.SHELL', () => {
+    // Arrange / Act / Assert
+    expect(defaultShellForPlatform('win32', {})).toBe('powershell.exe')
+    expect(defaultShellForPlatform('win32', { SHELL: '/bin/zsh' })).toBe('powershell.exe')
+  })
+
+  test('returns env.SHELL on darwin when it is set', () => {
+    // Arrange
+    const env = { SHELL: '/opt/homebrew/bin/fish' }
+
+    // Act
+    const result = defaultShellForPlatform('darwin', env)
+
+    // Assert
+    expect(result).toBe('/opt/homebrew/bin/fish')
+  })
+
+  test('falls back to /bin/zsh on darwin when env.SHELL is unset', () => {
+    expect(defaultShellForPlatform('darwin', {})).toBe('/bin/zsh')
+  })
+
+  test('returns env.SHELL on linux when it is set', () => {
+    expect(defaultShellForPlatform('linux', { SHELL: '/usr/bin/bash' })).toBe('/usr/bin/bash')
+  })
+
+  test('falls back to /bin/bash on linux when env.SHELL is unset', () => {
+    expect(defaultShellForPlatform('linux', {})).toBe('/bin/bash')
+  })
+})