Add a cross-platform desktop app (Fyne)

The tunnel client now has a desktop UI over the same internal/client
service: status with live connection state, routes with add/remove/copy,
live logs, settings, profile import, and a start/stop button that runs
the bridge in-process. It uses the existing ~/.config/tunnel/config.json
and shows a warning banner with a stop button when the CLI service is
already running and claiming the routes.

AGENTS.md

@@ -18,8 +18,12 @@ what we take vs. skip). Never vendor it into the build.
 - `cmd/tunneld` — flags/env wiring, listeners, signal handling
 - `cmd/tunnel` — the native Go client/CLI: JSON config, provisioning, routes,
   background service
+- `cmd/tunnel-desktop` — Fyne desktop UI over the same client service (macOS,
+  Linux, Windows)
 - `internal/client` — client implementation: config/API, key/CSR/certificate
   storage, bridge WebSocket, TLS termination and local proxying
+- `internal/desktop` — Fyne UI: status, routes, start/stop, logs, settings,
+  import
 - `internal/server/limits.go`, `cooldown.go` — per-IP/per-tunnel rate limits
   and the ACME CA cool-down
 - `internal/server/proto.go` — wire types (pinned JSON key order), IDs/tokens
@@ -68,6 +72,10 @@ what we take vs. skip). Never vendor it into the build.
   `up`/`down` manage the background service, `status` shows local + server
   state. `import --profile <name> --api <url>` takes over an official CLI
   profile (same tunnel/key/cert).
+- Desktop app: `go build -o .local/tunnel-desktop ./cmd/tunnel-desktop` (Fyne;
+  needs CGO). It runs the same `internal/client` service in-process and uses
+  `~/.config/tunnel/config.json`. If the CLI service is already running, stop
+  it first — the app shows a banner and offers to stop it.
 - Dev loop: `go build -o .local/tunneld ./cmd/tunneld && .local/tunneld -domain localhost`,
   then `OPENTUNNEL_API=http://localhost:8080 opentunnel route add 4096 --name api`
   with the official CLI. `go build` drops a binary next to the source — it is
@@ -172,8 +180,9 @@ what we take vs. skip). Never vendor it into the build.
 - The bridge WebSocket must use `coder/websocket` with compression disabled
   and the `opentunnel` subprotocol; read limits are 64 KiB before attach and
   4+32 KiB after.
-- No third-party deps beyond `github.com/coder/websocket` and
-  `golang.org/x/crypto` (ACME); keep it that way unless a milestone calls for it.
+- No third-party deps beyond `github.com/coder/websocket`,
+  `golang.org/x/crypto` (ACME), and `fyne.io/fyne/v2` (desktop UI). Keep it
+  that way unless a milestone calls for it.
 - **CLI release**: `v0.1.0` (tag on `ebae420`) is published on Gitea with
   darwin/linux arm64+amd64 tarballs and `checksums.txt`. The Homebrew formula
   is `tzgyn-tunnel` in `TZGyn/homebrew-tap` (it installs the `tunnel` binary;
@@ -183,7 +192,8 @@ what we take vs. skip). Never vendor it into the build.
   detached process, not a launchd agent (the official CLI's agent was stopped
   when the live tunnel was switched to this client).
 - Milestones: M1 core data path (done); M2 real ACME DNS-01 + renewals (done);
-  M3 rate limits/admin/hardening (done); M4 Go client (done). Remaining optional
-  work: export/import admin endpoints, token rotation, multi-region mesh,
-  inbound PROXY protocol, per-connection wire flow control (the protocol has
-  none; queues are bounded).
+  M3 rate limits/admin/hardening (done); M4 Go client (done); M5 desktop app
+  (done). Remaining optional work: launchd/systemd agents for the Go client,
+  release packaging for the desktop app, export/import admin endpoints, token
+  rotation, multi-region mesh, inbound PROXY protocol, per-connection wire
+  flow control (the protocol has none; queues are bounded).