desktop: Import and Export work offline; the menu toggle is reachable; errors say why

Export and Import were a link to the server and a reject("needs a server") on the
desktop. Both now run in the core with no server:

- core/src/local/portable.rs builds the same zip the server writes (notes.json,
  a Markdown file per note, each attachment this device holds) and reads either
  export marker or a Google Keep Takeout zip, with the server's decompression
  budget and an all-or-nothing transaction. Export saves to Downloads (no new
  plugin) and the sidebar says where; Import takes the archive as raw IPC bytes.
- core/testdata/portable.json pins the format for both copies: the server runs
  its Keep and native readers against it (test_portable_fixture.py) and checks
  its real export's keys (test_integration.py); the core runs the same cases.
- Found on the way: both importers skipped a Keep note that is only a photo as
  "empty". It now imports, on the server and in the core.
- New dependency, approved: `zip` (deflate only) plus `flate2` on its pure-Rust
  backend, both already in the lockfile.

The AppImage applications-menu toggle moves from Account, which the desktop
never shows, to the Sync page; the first-run prompt now says so.

errorMessage (#5236) replaces the hand-rolled `.error ?? …` / `.message ?? e`
reads at the remaining catch sites, so a desktop failure shows its real reason.

Task #5170.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/views/LoginView.vue

@@ -5,7 +5,7 @@ import { useSessionStore } from "../stores/session";
 import { useConfigStore } from "../stores/config";
 import BaseInput from "../components/BaseInput.vue";
 import BaseButton from "../components/BaseButton.vue";
-import type { ApiError } from "../api/client";
+import { errorMessage } from "../api/errors";
 
 const session = useSessionStore();
 const config = useConfigStore();
@@ -33,7 +33,7 @@ async function submit() {
     await session.login(email.value, password.value);
     await router.replace(safeRedirect(route.query.redirect));
   } catch (e) {
-    error.value = (e as ApiError).error ?? "Could not sign in.";
+    error.value = errorMessage(e, "Could not sign in.");
   } finally {
     loading.value = false;
   }