Add the Fyne desktop app (M5)

A cross-platform desktop UI over the same client service: status,
routes with add/remove/copy/open, live logs, settings, official-profile
import, and start/stop. It uses the existing JSON config and offers to
stop a running CLI daemon so the two do not fight over routes. The app
can autostart the service, refreshes status/config every few seconds,
and builds as a macOS .app via scripts/build-desktop-app.sh.

AGENTS.md

@@ -75,7 +75,11 @@ what we take vs. skip). Never vendor it into the build.
 - Desktop app: `go build -o .local/tunnel-desktop ./cmd/tunnel-desktop` (Fyne;
   needs CGO). It runs the same `internal/client` service in-process and uses
   `~/.config/tunnel/config.json`. If the CLI service is already running, stop
-  it first — the app shows a banner and offers to stop it.
+  it first — the app shows a banner and offers to stop it. `--autostart`
+  connects on launch. On macOS, `scripts/build-desktop-app.sh <version>` builds
+  and ad-hoc signs `Tunnel.app`; the installed copy is
+  `~/Applications/Tunnel.app`. Cross-OS builds need that OS's CGO toolchain;
+  `CGO_ENABLED=0` does not work for Fyne.
 - Dev loop: `go build -o .local/tunneld ./cmd/tunneld && .local/tunneld -domain localhost`,
   then `OPENTUNNEL_API=http://localhost:8080 opentunnel route add 4096 --name api`
   with the official CLI. `go build` drops a binary next to the source — it is