Add an Electron desktop shell for the SPA

desktop/ serves the normal frontend build over a privileged app://j621
scheme, so localStorage, OPFS, Web Workers, WebCodecs and history routing
behave exactly like Chrome. Development points at the Vite dev server;
`npm run smoke` runs headless Electron and checks the bundled app.

External links open in the system browser, and download navigations
(?download=1 or media URLs) are rerouted through webContents.downloadURL,
since preventing them cancels the download. The setup screen names the
shell's origin when the connection test fails, and the deploy docs list
app://j621 for CORS_ALLOWED_ORIGINS.

deploy/.env.example

@@ -31,6 +31,9 @@ ALLOWED_HOSTS=j621.rainbow-herring.ts.net,localhost,127.0.0.1
 # Cross-origin access (needed for the separate frontend + backend deploys)
 # ---------------------------------------------------------------------------
 # The origin the SPA is served from, e.g. https://j621-frontend.<tailnet>.ts.net
+# The desktop app (desktop/) is served from app://j621, so add that origin too
+# when it should reach this backend:
+#   CORS_ALLOWED_ORIGINS=https://j621-frontend.<tailnet>.ts.net,app://j621
 # CORS_ALLOWED_ORIGINS=
 # CSRF_TRUSTED_ORIGINS=
 

deploy/README.md

@@ -92,6 +92,10 @@ The SPA asks where the backend is (`/setup`) in production builds:
   backend's funnel URL, e.g. `https://j621-backend.<tailnet>.ts.net:8443`,
   and give the backend `CORS_ALLOWED_ORIGINS=https://<frontend-host>.<tailnet>.ts.net`
   (plus `CSRF_TRUSTED_ORIGINS` for the admin).
+- **Desktop app** — the Electron shell (`desktop/`) is served from the
+  `app://j621` origin, so it needs that entry too:
+  `CORS_ALLOWED_ORIGINS=...,app://j621`. The shell's setup screen prints the
+  exact origin when the connection test fails.
 - Without a backend at all, choose **"Continue without a backend"** to run in
   local mode (e621 browsing only).