Fix OIDC login in desktop: sync apiUrl before startLogin, add app icon

- Config.svelte: call setConfig() before startLogin() so fetchConfig
  uses the user-entered server URL
- Makefile: copy icon.icns into .app bundle Resources
- Info.plist: add CFBundleIconFile entry

web/src/pages/Config.svelte

@@ -66,6 +66,7 @@
   async function loginWithAuthentik() {
     error = ''
     oidcLoggingIn = true
+    setConfig({ apiUrl: apiUrl.trim(), token: '' })
     try {
       await startLogin()
     } catch (e: any) {