feat(app): Tauri 2 control app — tray + dashboard, thin FR-CTRL client (#181)

[linhdmn]

What

Implements #181 (FR-UI-01..09, PRD §20.4): the cross-platform desktop control app as a Tauri 2 tray + dashboard, a thin client of the FR-CTRL daemon (internal/daemon). Entirely new app/ tree (+ one CI workflow); nothing existing is touched.

Closes #181

Design decision: HTTP/SSE in the Rust core, not the webview

The daemon rejects non-loopback Origin headers (drive-by CSRF guard, originAllowed). Tauri webviews present http://tauri.localhost as origin on Windows/Linux → every webview-side request would 403 there. Rust-side requests (ureq) carry no Origin, which the daemon treats as same-origin on all three OSes. The webview talks to the core via Tauri commands + daemon://* events only. Documented in app/README.md and src-tauri/src/daemon.rs.

FR-UI row → implementation map

Row	Pri	Status	Where
FR-UI-01 tray state	M	functional	state.rs (idle/running/failed/offline/auth-failed from GET /status; circuit open→failed; precedence unit-tested) + 5s poll loop, per-state tray icons, menu, left-click deep-link
FR-UI-02 dispatch sheet	M	functional	dialog (prompt/role/worker/repoPath/autoPr/budget) → POST /dispatch; payload mirrors parseDispatch incl. autoPr only on explicit true
FR-UI-03 dashboard + log tail	M	functional	/agents roster+queue, /events SSE live tail (500-line cap, stick-to-bottom), /history tab
FR-UI-04 approvals + notifications	M	functional	verdict:"ask" rows (same signal as TUI pickPausedTask fallback) → native notification + inbox; Approve/Deny → POST /approve (y/n shorthand; __kill__ deliberately not exposed from the app)
FR-UI-05 autostart + single-instance	S	wired, best-effort	both plugins initialized; second launch focuses the dashboard. Only manually sanity-checked on macOS
FR-UI-06 signed builds + updater	S	scaffolded, by design	CI workflow documents exact secrets (APPLE_API_ISSUER/KEY, Windows PFX) + tauri-plugin-updater steps; signing NOT faked; updater plugin deliberately not added (dead config without signed releases)
FR-UI-07 thin client	M	enforced	all daemon I/O in daemon.rs; only credential source is the daemon's own daemon-token file; daemon-down → UI shows "degrade to CLI"
FR-UI-08 pipeline DAG view	M	functional (minimal)	pipeline.rs folds SSE rows into per-run stage timeline scout→plan→implement→gates→pr (G0–G5 collapse into gates; loopdriver loop-phase mapped; status/elapsed/retries); static fallback rebuilt from /history
FR-UI-09 3-OS CI parity gate	S	scaffolded, by design	real 3-OS matrix (macOS/Ubuntu/Windows: tsc + cargo check + debug build); not a required check until FR-UI-06 lands — enabling steps documented in the workflow

Evidence

• CARGO_BUILD_JOBS=2 cargo check: clean, 0 warnings
• cargo test: 11 passed, 0 failed (aggregate-state precedence + malformed-body tolerance; pipeline reducer: stage mapping, gate collapse, loop-phase mapping, retry counting, elapsed spans, ts parsing)
• tsc -p tsconfig.json: clean (strict mode)
• pnpm build (esbuild): ui/main.js 7.8kb
• cargo build (debug, --no-bundle equivalent): succeeds — binary devagent-control produced (workstation cargo config redirects target-dir to ~/.cache/cargo-target/leankg-target/debug/devagent-control)
• Full pnpm tauri build bundle not run locally (needs display/signing identity); CI matrix scaffold covers compile-parity on all 3 OSes

Notes

• UI is plain TS + esbuild (~8kb bundle), no framework, per the leanest-stack constraint.
• Config surface: base URL via DEVAGENT_DAEMON_URL or in-app Settings; token read from DEVAGENT_HOME/daemon-token (0600) or pasted in Settings (memory-only).
• PRD untouched (coordinator owns §20.x updates).