fix(desktop): stop shipping node-gyp, which broke codesign

`npm run dist:mac` failed at the signing step:

  codesign --timestamp .../node_modules/node-gyp/gyp/pylib/gyp/generator/\
    __pycache__/make.cpython-313.pyc
  → "A timestamp was expected but was not found."

node-gyp only COMPILES native modules. Nothing loads it at runtime — node-pty
resolves its prebuilt .node directly, and a grep over the packaged tree finds no
require of it outside the package itself. But it vendors a Python tree, and
`npmRebuild: true` runs it and leaves __pycache__/*.pyc behind. Those got copied
into Contents/Resources and codesign then tried to sign Python bytecode, which
takes the entire build down.

Excluding it removes both the dead weight (5 MB) and the failure surface. Also
excludes **/__pycache__ outright, so no Python bytecode can reach the bundle by
another route.

Verified on a real build: signature verifies --strict, node-gyp absent, zero .pyc
in the bundle, public/style.css and build/main.js byte-identical to the repo,
express/ws/web-push/qrcode/google-auth-library all still resolve from the
packaged tree, and node-pty's Electron-ABI pty.node is in place.

Note: the immediate failure was transient — a plain retry of the same config
succeeded (Apple's timestamp server). So this is the durable fix for a landmine
that would otherwise re-arm on every npmRebuild, not the cause of that one run.

Deviation from the one-worktree-per-session rule: the desktop build packages from
desktop/node_modules and its script does `cd .. && npm run build`, so it can only
be exercised in the main checkout. Committed on develop directly.

desktop/electron-builder.yml

@@ -56,6 +56,15 @@ extraResources:
       - "!7zip-bin/**"
       - "!@electron/**"
       - "!@develar/**"
+      # node-gyp only COMPILES native modules; nothing loads it at runtime (node-pty
+      # resolves its prebuilt .node directly). It also ships a vendored Python tree,
+      # and `npmRebuild` leaves __pycache__/*.pyc behind in it — codesign then tries
+      # to sign those and fails with "A timestamp was expected but was not found",
+      # taking the whole build down. Excluding the package removes both the dead
+      # weight and the failure surface.
+      - "!node-gyp/**"
+      # Belt and braces: no Python bytecode anywhere in the shipped tree.
+      - "!**/__pycache__/**"
 # Rebuild native deps (node-pty) against the Electron ABI before packaging + copy.
 npmRebuild: true
 mac: