core: extract the store and sync engine into a shared crate (M12 step 1)

Android becomes a native Kotlin client over this same code (Scribe note 2730), so
the local store and sync engine stop being modules of the desktop app and become
`thoughtsync-core`, a crate with no UI framework in it at all.

This is a move, not a rewrite, and the measurement is why: every file in local/
and sync/ already carried ZERO Tauri references — 4,980 of 6,372 lines. The
coupling was 473 lines of command shim, which stays behind in the desktop crate
as src/commands/. Kept as git renames so history follows the files.

The desktop imports them under their old names (`use thoughtsync_core::{local,
sync}`) so every call site reads exactly as before. What moved is where they
live, not what they are.

Two things a workspace changes that are easy to miss, both caught before pushing:

[profile.release] now lives at the workspace ROOT. Cargo silently ignores
profiles declared by a non-root member — leaving it in the desktop crate would
have dropped lto/strip/opt-level from every release build with only a warning.

And a workspace shares ONE target dir, so the bundles moved from
desktop/src-tauri/target to target/. Thirteen references across publish-release,
debundle-graphics, verify.sh, package-prebuilt and the workflow now point there.
Pinning target-dir back would have been the smaller diff, but the Android lane
also produces Rust artifacts and they do not belong under desktop/.

Also retires the Tauri Android lane in the same push rather than leaving a path
that is being replaced: gen/android, android.yml and docs/android-dev.md are
gone, the mobile_entry_point attribute with them, and the lib drops to rlib —
staticlib/cdylib existed for Tauri mobile, and the .so Android loads will be
built from the core crate instead. Rule 22, no parallel path.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

desktop/packaging/appimage/debundle-graphics.sh

@@ -20,7 +20,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-BUNDLE_DIR="$REPO_ROOT/desktop/src-tauri/target/release/bundle/appimage"
+BUNDLE_DIR="$REPO_ROOT/target/release/bundle/appimage"
 
 # appimagetool is published only under the rolling "continuous" tag (the project
 # cuts no semver releases), so this URL is the pinned distribution channel.
@@ -90,7 +90,7 @@ fi
 echo "==> Locating appimagetool"
 # Prefer the copy Tauri already downloaded during the build (no network, and
 # version-matched to the toolchain that produced the AppImage).
-APPIMAGETOOL="$(find "$REPO_ROOT/desktop/src-tauri/target" -name 'appimagetool-*.AppImage' -type f 2>/dev/null | head -n1 || true)"
+APPIMAGETOOL="$(find "$REPO_ROOT/target" -name 'appimagetool-*.AppImage' -type f 2>/dev/null | head -n1 || true)"
 if [ -z "${APPIMAGETOOL:-}" ]; then
   echo "    not cached by Tauri; downloading from continuous channel"
   APPIMAGETOOL="$WORK/appimagetool"

desktop/packaging/arch/package-prebuilt.sh

@@ -29,8 +29,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
 
 SRC_TAURI="$REPO_ROOT/desktop/src-tauri"
-BINARY="$SRC_TAURI/target/release/thoughtsync"
-OUT_DIR="${1:-$SRC_TAURI/target/release/bundle/arch}"
+BINARY="$REPO_ROOT/target/release/thoughtsync"
+OUT_DIR="${1:-$REPO_ROOT/target/release/bundle/arch}"
 
 PKGNAME="thoughtsync"
 # The name this package used to ship under. pacman needs both to retire it: without

desktop/packaging/deb/verify.sh

@@ -33,7 +33,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
-DEB_DIR="$REPO_ROOT/desktop/src-tauri/target/release/bundle/deb"
+DEB_DIR="$REPO_ROOT/target/release/bundle/deb"
 
 shopt -s nullglob
 DEBS=("$DEB_DIR"/*.deb)

desktop/packaging/publish-release.sh

@@ -14,10 +14,10 @@
 # for a tag that already exists.
 #
 # The build + de-bundle steps run first; this consumes their output:
-#   desktop/src-tauri/target/release/bundle/appimage/*.AppImage  (de-bundled)
-#   desktop/src-tauri/target/release/bundle/deb/*.deb
-#   desktop/src-tauri/target/release/bundle/arch/*.pkg.tar.*     (prebuilt pacman)
-#   desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+#   target/release/bundle/appimage/*.AppImage  (de-bundled)
+#   target/release/bundle/deb/*.deb
+#   target/release/bundle/arch/*.pkg.tar.*     (prebuilt pacman)
+#   target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
 #
 # Instance-agnostic: server + repo come from the runner's github.* context
 # (Forgejo populates them for compatibility), so nothing is hardcoded to one host.
@@ -44,9 +44,9 @@ AUTH=(-H "Authorization: token $GITHUB_TOKEN")
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-BUNDLE_ROOT="$REPO_ROOT/desktop/src-tauri/target/release/bundle"
+BUNDLE_ROOT="$REPO_ROOT/target/release/bundle"
 # Cross-compiled Windows output lands under the target triple, not the host root.
-WIN_BUNDLE_ROOT="$REPO_ROOT/desktop/src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
+WIN_BUNDLE_ROOT="$REPO_ROOT/target/x86_64-pc-windows-msvc/release/bundle"
 
 # --- collect the assets to upload -------------------------------------------
 shopt -s nullglob