rename: the desktop is Inkwell — crates, Tauri identity, data move, packaging

Step 3 of milestone 481 (Scribe note 5071: a full rename).

- crates thoughtsync-{core,desktop,ffi,uniffi-bindgen} → inkwell-*, the
  Cargo.lock entries moved to match (checked with `cargo metadata --locked`)
- Tauri: productName "Inkwell", identifier com.fabledsword.inkwell, binary
  `inkwell`, updater feed on bvandeusen/inkwell, store file inkwell.db
- client agent inkwell-desktop, headers X-Inkwell-Client/-Protocol (the server
  reads neither), capture event inkwell://captured, display-version env
- .deb: conflicts + replaces thought-sync, so the updater's install retires the
  old package instead of colliding on it. kebab-case("Inkwell") is `inkwell`, so
  the package name finally matches the command and verify.sh now asserts it
- pacman: inkwell, conflicting with and replacing thoughtsync and
  thoughtsync-desktop
- AppImage ~/Applications/Inkwell.AppImage, menu entry inkwell.desktop,
  installer, release titles, desktop asset names in fetch-clients.sh

The one shim, chosen by the operator because it is the only copy of a
local-first user's notes: crossover.rs moves the old
com.fabledsword.thoughtsync app-data dir's contents into the new one on startup,
before the store opens, renaming thoughtsync.db and its -wal/-shm with it. It
skips when the new dir already has a store, and anything already in the new dir
wins (the installer writes its channel marker there first). Tested.

Android's Kotlin side (package, applicationId, uniffi class) is step 4. Its
release asset names stay thoughtsync.* until then.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

desktop/src-tauri/src/lib.rs

@@ -1,16 +1,17 @@
-//! ThoughtSync desktop (Tauri v2).
+//! Inkwell desktop (Tauri v2).
 //!
 //! The window loads the shared Vue 3 frontend (`../../frontend`), which reaches the
 //! store and sync engine through the `frontend/src/adapters/` seam (M10.3) over Tauri
 //! `invoke`.
 //!
 //! This crate is the DESKTOP WRAPPER, not the core. The on-device SQLite store and
-//! the sync engine live in `thoughtsync-core`, shared with the Android client; what
+//! the sync engine live in `inkwell-core`, shared with the Android client; what
 //! remains here is the Tauri command surface (`commands`), desktop integration
 //! (menu-entry install for the Linux AppImage), the in-app updater, and boot.
 
 mod capture;
 mod commands;
+mod crossover;
 mod integration;
 mod update;
 
@@ -37,7 +38,7 @@ mod update;
 /// filenames and `latest.json` and must never be shown to a person (#3144). Two
 /// values, two audiences. `update.rs` deliberately still reads the key, through
 /// `app.package_info().version`, because a comparator is exactly what it is.
-const DISPLAY_VERSION: Option<&str> = option_env!("THOUGHTSYNC_DISPLAY_VERSION");
+const DISPLAY_VERSION: Option<&str> = option_env!("INKWELL_DISPLAY_VERSION");
 
 /// The baked build, or the honest "I cannot say". The only way in — the const is
 /// private so no caller can reach past the fallback.
@@ -45,11 +46,11 @@ pub(crate) fn display_version() -> &'static str {
     DISPLAY_VERSION.unwrap_or("unknown")
 }
 
-// The store and the sync engine live in the shared `thoughtsync-core` crate, which
+// The store and the sync engine live in the shared `inkwell-core` crate, which
 // the Android client binds through uniffi (Scribe note 2730). Aliased to their old
 // names so every call site below reads exactly as it did when they were modules of
 // this crate — the extraction changed where they live, not what they are.
-use thoughtsync_core::{local, sync};
+use inkwell_core::{local, sync};
 
 pub fn run() {
     use tauri_plugin_log::{Target, TargetKind};
@@ -58,7 +59,7 @@ pub fn run() {
     // The core cannot work this out — it is compiled into the Android app too — so
     // the header says "desktop" only because the desktop says so here, and carries
     // the build a person can read rather than the core crate's own version.
-    sync::compat::set_client_agent("thoughtsync-desktop", display_version());
+    sync::compat::set_client_agent("inkwell-desktop", display_version());
 
     #[cfg(target_os = "linux")]
     harden_linux_webkit_rendering();
@@ -111,11 +112,17 @@ pub fn run() {
             log_environment(app);
             paint_window_before_the_webview_does(app);
             // The on-device store lives in the platform app-data dir (e.g. Linux
-            // ~/.local/share/com.fabledsword.thoughtsync/thoughtsync.db), created on
+            // ~/.local/share/com.fabledsword.inkwell/inkwell.db), created on
             // first launch. This is what makes the app work with no server or login.
             let dir = app.path().app_data_dir()?;
+            // Before the store opens: an install from when this app was ThoughtSync
+            // has its notes in the old identifier's dir, beside this one.
+            if let Some(root) = dir.parent() {
+                let legacy = root.join(crossover::LEGACY_IDENTIFIER);
+                log_crossover(&legacy, crossover::adopt_legacy_data(&legacy, &dir));
+            }
             std::fs::create_dir_all(&dir)?;
-            let db_path = dir.join("thoughtsync.db");
+            let db_path = dir.join(crossover::DB_FILE);
             log::info!("opening local store: {}", db_path.display());
             let db = local::open(&db_path)?;
             log::info!("local store ready — {}", local::summary(&db));
@@ -261,6 +268,17 @@ fn log_event(level: String, message: String) {
     }
 }
 
+/// The startup log line for the ThoughtSync → Inkwell data crossover (crossover.rs).
+fn log_crossover(legacy: &std::path::Path, result: std::io::Result<crossover::Outcome>) {
+    match result {
+        Ok(crossover::Outcome::Moved(n)) => {
+            log::info!("moved {n} entries from {}", legacy.display())
+        }
+        Ok(outcome) => log::debug!("ThoughtSync data crossover: {outcome:?}"),
+        Err(e) => log::warn!("could not move data from {}: {e}", legacy.display()),
+    }
+}
+
 /// Log the app version and the environment that determines whether the window
 /// renders — the first thing to check when a build works on one machine but not
 /// another.