Add the Fyne desktop app (M5)

A cross-platform desktop UI over the same client service: status,
routes with add/remove/copy/open, live logs, settings, official-profile
import, and start/stop. It uses the existing JSON config and offers to
stop a running CLI daemon so the two do not fight over routes. The app
can autostart the service, refreshes status/config every few seconds,
and builds as a macOS .app via scripts/build-desktop-app.sh.

README.md

@@ -98,7 +98,16 @@ client service:
 
 ```bash
 go build -o .local/tunnel-desktop ./cmd/tunnel-desktop
-.local/tunnel-desktop
+.local/tunnel-desktop            # click Start
+.local/tunnel-desktop --autostart
+```
+
+On macOS, build and ad-hoc sign a launchable bundle:
+
+```bash
+./scripts/build-desktop-app.sh 0.2.0
+ditto Tunnel.app "$HOME/Applications/Tunnel.app"
+open "$HOME/Applications/Tunnel.app" --args --autostart
 ```
 
 It uses `~/.config/tunnel/config.json` like the CLI, shows tunnel status and
@@ -107,6 +116,11 @@ and profile import, and has a start/stop button that runs the service
 in-process. If the CLI service is already running, a banner offers to stop it
 first.
 
+Fyne needs CGO: the macOS build is tested; Linux and Windows must be built on
+those platforms (or with a native CGO cross toolchain), not with
+`CGO_ENABLED=0`. Distribution of the macOS app still needs Developer ID signing
+and notarization (the local script only ad-hoc signs).
+
 ## Configuration
 
 Every flag also reads an environment variable (`tunneld -h`):