Add a cross-platform desktop app (Fyne)

The tunnel client now has a desktop UI over the same internal/client
service: status with live connection state, routes with add/remove/copy,
live logs, settings, profile import, and a start/stop button that runs
the bridge in-process. It uses the existing ~/.config/tunnel/config.json
and shows a warning banner with a stop button when the CLI service is
already running and claiming the routes.

README.md

@@ -6,9 +6,9 @@ plaintext or private keys. It speaks the exact wire protocol from
 `docs/protocol.md`, so the official `opentunnel` CLI and SDK work against it
 unchanged.
 
-Status: **M4** — the data path, real ACME DNS-01 certificates with renewal,
-rate limits/hardening, and a native Go client are implemented. The official
-`opentunnel` CLI still works unchanged.
+Status: **M5** — the data path, real ACME DNS-01 certificates with renewal,
+rate limits/hardening, a native Go client, and a cross-platform desktop UI are
+implemented. The official `opentunnel` CLI still works unchanged.
 
 ## Quick start (local development)
 
@@ -91,6 +91,22 @@ tunnel up
 the official TOML routes to JSON. Both clients cannot claim the same routes at
 the same time — stop one before starting the other.
 
+## Desktop app
+
+A cross-platform desktop UI (Fyne, macOS/Linux/Windows) is built into the same
+client service:
+
+```bash
+go build -o .local/tunnel-desktop ./cmd/tunnel-desktop
+.local/tunnel-desktop
+```
+
+It uses `~/.config/tunnel/config.json` like the CLI, shows tunnel status and
+certificate expiry, routes with copy/open/remove buttons, live logs, settings
+and profile import, and has a start/stop button that runs the service
+in-process. If the CLI service is already running, a banner offers to stop it
+first.
+
 ## Configuration
 
 Every flag also reads an environment variable (`tunneld -h`):
@@ -251,6 +267,8 @@ setup is needed.
   tunnels
 - Native Go client (`cmd/tunnel`): JSON config, routes with live reload,
   PROXY protocol, background service, and import of the official CLI profile
+- Desktop UI (`cmd/tunnel-desktop`): Fyne app with status, routes, logs,
+  settings, and start/stop
 - Graceful shutdown: `drain` + close to every bridge
 
 ## Not yet (later)