feat(desktop): Tauri mac shell around the web export

Black screen root cause: Tauri injects nonces into style-src, which
makes WebKit drop 'unsafe-inline' and block react-native-web's inline
style attributes. style-src is now excluded from CSP modification.
Window opens on the home screen so the section menu is reachable.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Wmf3K9nCoEsXvvwkmMnuiM

desktop/src-tauri/scripts/export-web.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Re-export the Expo web frontend for the Tauri desktop shell.
+#
+# Runs from src-tauri/ as Tauri's beforeBuildCommand, or from desktop/ by hand.
+# `frontendDist` points at ../app/dist in the repo root, so a plain release
+# build of an unchanged tree simply re-bundles the last committed export —
+# exactly like the web deploy copies app/dist to the VPS.
+#
+# Node 22 only (matches app/.nvmrc and CI): newer npm writes lockfiles that
+# CI's npm 10 refuses, so force the hermes node 22 toolchain if present.
+set -eu
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+case "$HERE" in
+  */desktop/src-tauri/scripts)
+    # invoked as src-tauri/scripts/export-web.sh (Tauri hook cwd): repo is two up
+    ROOT="$(cd "$HERE/../../.." && pwd)" ;;
+  */desktop/scripts)
+    # invoked as desktop/scripts/export-web.sh: repo is two up
+    ROOT="$(cd "$HERE/../.." && pwd)" ;;
+  *)
+    ROOT="$(cd "$HERE/../.." && pwd)" ;;
+esac
+
+if [ -x "$HOME/.hermes/node/bin/node" ]; then
+  export PATH="$HOME/.hermes/node/bin:$PATH"
+fi
+
+NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
+if [ "$NODE_MAJOR" != "22" ]; then
+  echo "export-web.sh: need node 22 (have $(node -v)); refusing to run" >&2
+  exit 1
+fi
+
+cd "$ROOT/app"
+npx expo export --platform web
+echo "export-web.sh: exported to $ROOT/app/dist"