Wails v3 desktop app: scaffold, shell features, token mgmt, auto-update, CI

Problem: the Oikos control room was browser-only — no native desktop
experience (system tray, notifications, keychain-persisted auth).

Change: add a Wails v3 thin-shell desktop app at cmd/desktop/ that embeds
the existing SPA in a webview. The Go side is ~380 lines — no bundled
server, no Postgres connection. It reads auth from the OS keychain,
injects it into the SPA on load, and the SPA talks HTTPS to the homelab
same as a browser.

Phase 1.0 — Scaffold + window:
  - Embed web/dist/ into the Wails binary
  - Inject window.__OIKOS_CONFIG__ with keychain-stored apiUrl + token
  - 1400×900 window, min 1024×700
  - System tray: Open/Quit, click toggles window

Phase 1.1 — Native shell:
  - Poll /api/v1/dashboard/summary every 30s; osascript notification
    when approvals or critical signals increase
  - Save/restore window position to ~/.config/oikos/window.json
  - EnableAutoStart/DisableAutoStart — macOS LaunchAgent plist

Phase 1.2 — Token management:
  - Config.svelte calls window.wails.Call.ByName('SaveConfig') after
    successful connection — persists to OS keychain
  - ConfigService binds SaveConfig, ClearConfig, EnableAutoStart,
    DisableAutoStart to the Wails runtime

Phase 1.3 — Auto-update:
  - Poll Gitea releases API every 6h, compare semver, show dialog
  - 'Check for Updates' tray menu item triggers immediate poll

Phase 1.4 — Distribution:
  - macOS entitlements.plist: network client + keychain access
  - .gitea/workflows/desktop.yml: CI builds macOS arm64 + Linux amd64
    on 'desktop-*' / 'v*' tags, attaches artifacts to release
  - Makefile: desktop (build), desktop-package (build + zip/tar.gz)
  - CONTRIBUTING.md: documented desktop app + commands

Risk: low. Wails v3 alpha API may shift; the Go glue is ~380 lines and
trivially portable. The desktop app is additive — zero changes to the
existing server or SPA logic. No config mutation, no infrastructure
impact.

Verification: go build, go vet, go mod tidy all pass.

.gitea/workflows/desktop.yml

@@ -0,0 +1,96 @@
+name: Desktop App
+on:
+  push:
+    tags:
+      - 'desktop-*'
+      - 'v[0-9]+.[0-9]+.[0-9]*'
+
+jobs:
+  build-ui:
+    name: Build SPA
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+          cache-dependency-path: web/package-lock.json
+      - run: npm ci
+        working-directory: web
+      - run: npm run build
+        working-directory: web
+      - uses: actions/upload-artifact@v4
+        with:
+          name: spa-dist
+          path: web/dist/
+
+  build-macos-arm64:
+    name: macOS (arm64)
+    needs: build-ui
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: spa-dist
+          path: cmd/desktop/frontend/dist/
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+      - run: go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+      - run: wails3 build -clean
+        working-directory: cmd/desktop
+        env:
+          CGO_ENABLED: 1
+      - run: |
+          cd cmd/desktop/build/bin
+          zip -r oikos-desktop-darwin-arm64.zip oikos-desktop.app
+      - uses: actions/upload-artifact@v4
+        with:
+          name: oikos-desktop-darwin-arm64
+          path: cmd/desktop/build/bin/oikos-desktop-darwin-arm64.zip
+
+  build-linux-amd64:
+    name: Linux (amd64)
+    needs: build-ui
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: spa-dist
+          path: cmd/desktop/frontend/dist/
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.26'
+      - run: sudo apt-get update && sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev
+      - run: go install github.com/wailsapp/wails/v3/cmd/wails3@latest
+      - run: wails3 build -clean
+        working-directory: cmd/desktop
+        env:
+          CGO_ENABLED: 1
+      - uses: actions/upload-artifact@v4
+        with:
+          name: oikos-desktop-linux-amd64
+          path: cmd/desktop/build/bin/oikos-desktop
+
+  release:
+    name: Create Release
+    needs: [build-macos-arm64, build-linux-amd64]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: oikos-desktop-darwin-arm64
+      - uses: actions/download-artifact@v4
+        with:
+          name: oikos-desktop-linux-amd64
+      - name: Release
+        uses: https://gitea.com/actions/release-action@v1
+        with:
+          files: |
+            oikos-desktop-darwin-arm64.zip
+            oikos-desktop-linux-amd64
+          api_key: ${{ secrets.GITEA_TOKEN }}