Add the Fyne desktop app (M5)

A cross-platform desktop UI over the same client service: status,
routes with add/remove/copy/open, live logs, settings, official-profile
import, and start/stop. It uses the existing JSON config and offers to
stop a running CLI daemon so the two do not fight over routes. The app
can autostart the service, refreshes status/config every few seconds,
and builds as a macOS .app via scripts/build-desktop-app.sh.

scripts/build-desktop-app.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# Build and ad-hoc sign a local macOS Tunnel.app.
+# Distribution releases still need Developer ID signing + notarization.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+VERSION="${1:-0.2.0}"
+BUILD="${BUILD:-1}"
+FYNE="$(command -v fyne || true)"
+if [ -z "$FYNE" ]; then
+  FYNE="$(go env GOPATH)/bin/fyne"
+fi
+if [ ! -x "$FYNE" ]; then
+  echo "installing fyne CLI..."
+  go install fyne.io/tools/cmd/fyne@latest
+  FYNE="$(go env GOPATH)/bin/fyne"
+fi
+
+mkdir -p .local
+go build -o .local/Tunnel -ldflags "-X main.version=$VERSION" ./cmd/tunnel-desktop
+rm -rf Tunnel.app
+"$FYNE" package -os darwin \
+  -executable .local/Tunnel \
+  -name Tunnel -app-id dev.tzgyn.tunnel \
+  -app-version "$VERSION" -app-build "$BUILD" \
+  -icon assets/icon.png -release
+
+codesign --force --deep --sign - Tunnel.app
+echo "Built and ad-hoc signed Tunnel.app (version $VERSION)."
+echo "Install locally with:"
+echo "  rm -rf \"\$HOME/Applications/Tunnel.app\" && ditto Tunnel.app \"\$HOME/Applications/Tunnel.app\""