feat(desktop): runtime-configurable backend server address

The desktop shell is one generic .deb/.AppImage distributed via
mca/public_releases, not built per-booth, but the backend origin was baked
in at build time (VITE_API_BASE, hardcoded to http://127.0.0.1:3000) — the
same installer could never point at a different appliance without a
rebuild.

Adds ConnectScreen (shown before Login in Tauri when no backend is saved),
backed by tauri-plugin-store persisting the operator-entered URL across
restarts. CSP's connect-src tightens to 'self' only — all backend traffic
already routes through tauri-plugin-http/websocket, which run Rust-side
and are outside connect-src's reach anyway — and the real access boundary
moves to capabilities/default.json's http:default scope, wildcarded so an
operator-chosen host is actually reachable. Adds a "Change server" control
in Setup (desktop-only) to repoint an already-configured install.

While tracing the desktop auth path for this: tauri-plugin-http's fetch()
runs through Rust's reqwest, which keeps its own cookie jar separate from
the webview, so document.cookie on tauri://localhost never sees the
parking_csrf cookie the server sets (open upstream bug,
tauri-apps/tauri#13045/#11518). This means the desktop app has likely been
silently sending no CSRF header on every mutation since the shell was
first built — pre-existing, independent of this change. Fixed by having
sessionView() (routes/auth.ts) also echo the CSRF value in the login/me
JSON body; the desktop client stashes it in memory and echoes that instead
of reading document.cookie. assertCsrf() itself is untouched.

Verified end-to-end against a real LAN-bound dev server: login returns a
csrfToken matching the cookie, a mutation using the body-sourced token in
X-CSRF-Token succeeds (200), and the same mutation without it still
correctly 403s.

apps/web/src/lib/backend-config.ts

@@ -0,0 +1,88 @@
+// Desktop-only: the operator-configured backend origin (host:port of the
+// Fastify server this install talks to), persisted across restarts.
+//
+// The desktop shell is a generic .deb/.AppImage — it is NOT built for one
+// specific booth, so the backend address can't be baked in at build time
+// (that was the old VITE_API_BASE approach; a rebuild was needed to point the
+// same installer at a different appliance). Instead the operator enters it
+// once in the ConnectScreen (shown before login whenever nothing usable is
+// stored yet) and it's saved to a JSON file in the OS config dir via
+// tauri-plugin-store, read back on every launch before any API call.
+//
+// Browser build: this module is never reached (inTauri() gates every call
+// site — see origin.ts), so there is no browser equivalent or fallback here.
+
+import type { Store } from "@tauri-apps/plugin-store";
+
+const STORE_FILE = "backend-config.json";
+const KEY = "backendUrl";
+
+let storeHandle: Store | null = null;
+async function getStore(): Promise<Store> {
+  if (!storeHandle) {
+    const { load } = await import("@tauri-apps/plugin-store");
+    storeHandle = await load(STORE_FILE, { autoSave: true });
+  }
+  return storeHandle;
+}
+
+/** The saved backend origin (no trailing slash), or null if never configured.
+ *  Desktop only — throws if called from a browser build. */
+export async function loadBackendUrl(): Promise<string | null> {
+  const store = await getStore();
+  const v = await store.get<string>(KEY);
+  return typeof v === "string" && v.length > 0 ? v.replace(/\/$/, "") : null;
+}
+
+/** Persist a new backend origin (validated + reachable — call testBackendUrl
+ *  first). Takes effect immediately for future platformFetch/wsUrl calls. */
+export async function saveBackendUrl(url: string): Promise<void> {
+  const store = await getStore();
+  await store.set(KEY, url.replace(/\/$/, ""));
+  await store.save();
+}
+
+/** Clear the saved backend (forces the ConnectScreen back up next launch). */
+export async function clearBackendUrl(): Promise<void> {
+  const store = await getStore();
+  await store.delete(KEY);
+  await store.save();
+}
+
+export interface BackendCheck {
+  ok: boolean;
+  /** "unreachable" (network/DNS/refused) | "bad_response" (reachable, not our API). */
+  reason?: "unreachable" | "bad_response";
+  detail?: string;
+}
+
+/** Probe a candidate origin by hitting /api/version. That route is behind
+ *  requirePermission("site:read") (session cookie + site:read — see
+ *  apps/server/src/routes/site.ts), so a pre-login probe can never get a 2xx;
+ *  we're not checking "is this reachable and mine to use", only "is something
+ *  that speaks our Fastify auth protocol listening here" — a 401 (missing/bad
+ *  JWT) or 403 (valid session, wrong permission) from THIS specific route is
+ *  as strong a signal of that as a 200 would be, and both are expected outcomes
+ *  pre-login. Uses the same tauri-plugin-http path platformFetch does (raw
+ *  fetch from the webview can't reach an arbitrary LAN host — mixed content,
+ *  see origin.ts). */
+export async function testBackendUrl(url: string): Promise<BackendCheck> {
+  const origin = url.replace(/\/$/, "");
+  try {
+    const { fetch: tauriFetch } = await import("@tauri-apps/plugin-http");
+    const res = await tauriFetch(`${origin}/api/version`, {
+      method: "GET",
+      signal: AbortSignal.timeout(5000),
+    });
+    if (!res.ok && res.status !== 401 && res.status !== 403) {
+      return { ok: false, reason: "bad_response", detail: `HTTP ${res.status}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    return {
+      ok: false,
+      reason: "unreachable",
+      detail: err instanceof Error ? err.message : String(err),
+    };
+  }
+}