feat: FEAT-002 local agent API, desktop tray spine, screenshot handler

Slices 1-3 of the local agent IPC surface:
- Read model (local_status.go, loop wired): update counts, scanner status,
  check-in state, token receipt counts — no token material exposed
- Local IPC (localapi/): Unix socket (group=redflag-local, 0660) + Windows
  named pipe (SDDL: LocalSystem/Admins/RedFlagLocal); five read-only endpoints
- `redflag-agent -local-status` CLI probe of the local API surface
- Screenshot capture handler (screenshot.go, dispatch wired)
- Tauri desktop spine (desktop/): tray icon, left-click window, local IPC reader
- Desktop React entry (web/src/desktop/LocalAgentApp.tsx, index.desktop.html,
  vite.desktop.config.ts)
- Installer group provisioning: linux.sh creates redflag-local, sets
  SupplementaryGroups; windows.ps1 creates RedFlagLocal security group
- Server-side: screenshot receipt handler on agents, updates handler additions
- web/package.json: @tauri-apps/api + tauri CLI dev dep added

web/package.json

@@ -5,13 +5,16 @@
   "type": "module",
   "scripts": {
     "dev": "vite",
+    "dev:desktop": "vite --config vite.desktop.config.ts --host 127.0.0.1",
     "build": "tsc && vite build",
+    "build:desktop": "tsc && vite build --config vite.desktop.config.ts",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "preview": "vite preview"
   },
   "dependencies": {
     "@tanstack/react-query": "^5.8.4",
     "@tanstack/react-query-devtools": "^5.90.2",
+    "@tauri-apps/api": "^2.0.0",
     "axios": "^1.15.0",
     "clsx": "^2.0.0",
     "lucide-react": "^0.294.0",
@@ -29,6 +32,7 @@
     "@types/react-dom": "^18.2.15",
     "@typescript-eslint/eslint-plugin": "^6.10.0",
     "@typescript-eslint/parser": "^6.10.0",
+    "@tauri-apps/cli": "^2.0.0",
     "@vitejs/plugin-react": "6.0.2",
     "autoprefixer": "^10.4.16",
     "eslint": "^8.53.0",