fix: transport escalation exempts log reads, get_entity accepts slug alias, add restart_service + push_file tools

P0: Transport escalation in classifyAndGate (server.go:745) now exempts
    log-inspection commands (tail/head/cat/journalctl on *.log or /logs/)
    from the /opt//etc//var/lib/ gating on LXC targets. Fixes the
    'tail -3 /opt/seanime/data/logs/seanime.log queued for approval' bug.

P1: queryEntity returns actionable error when slug_or_id param is empty
    ('slug_or_id is required') instead of silent 'entity not found: '.

P2: Added slugArg() helper (server.go) so get_entity, get_relations,
    get_blast_radius, and explain accept 'slug' as an alias for their
    declared param name. Solves the discoverability inconsistency where
    every tool used a different param name for the same concept.

P3: Two new MCP tools:
    - restart_service(target, service) — systemctl restart wrapper,
      correctly classified config_mutation (requires approval)
    - push_file(target, source_path, dest_path, backup=true) — pct push
      from Proxmox host into LXC, with optional backup. Classified
      config_mutation. LXC-only for now.

P4: Updated homelab-lxc-ops skill with MCP tools preference table.

Plus: Wails desktop build now uses build-tag approach for frontend embed
      (assets_embed.go + assets_stub.go), so go build ./... works on
      clean checkout without the frontend built first.

Version: 0.31.0 → 0.32.0

cmd/desktop/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"crypto/rand"
 	"crypto/sha256"
-	"embed"
+	_ "embed" // required by the //go:embed icon.png directive below
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -27,8 +27,10 @@ import (
 	"github.com/zalando/go-keyring"
 )
 
-//go:embed frontend/dist
-var assets embed.FS
+// assets is the embedded web SPA, defined in assets_embed.go (`desktop` build
+// tag, real //go:embed frontend/dist) and assets_stub.go (default build, empty
+// FS). frontend/dist is a gitignored artifact populated by `make desktop`; the
+// stub keeps `go build ./...` working on a clean checkout.
 
 //go:embed icon.png
 var iconPNG []byte