feat: add desktop native bridge skeleton

[rogerchappel]

Summary

• add a preload script exposing a narrow desktop bridge to the renderer
• add IPC handlers for app metadata, current server URL, and safe external navigation
• keep server URL writes, secure storage, notifications, tray, updater, signing, and runtime bundling out of scope

Stack

• Base PR: chore: scaffold desktop shell #275

Verification

• git diff --check
• node --check apps/desktop/src/main.cjs && node --check apps/desktop/src/preload.cjs
• cd apps/desktop && pnpm install --frozen-lockfile
• cd apps/desktop && pnpm check
• pnpm exec tsc --noEmit --pretty false
• push hook: pnpm typecheck
• push hook: pnpm build

Risk

Low-medium. This adds a minimal Electron bridge surface only and keeps product logic, auth, runtime management, and storage server-owned.