M10.6: HTTP transport for the handshake (task 1995)

Adds the client's first outbound call: GET {server}/api/config, carrying
X-ThoughtSync-Client and X-ThoughtSync-Protocol, feeding compat::evaluate.

Deliberately its OWN commit. This introduces the first HTTP+TLS stack into a
crate that cross-compiles to Windows from Linux via cargo-xwin — the lane
that has already broken once on a transitive C dependency (libsqlite3-sys
needing llvm-lib). Landing it alone means a failure here has exactly one
possible cause, instead of surfacing mid-way through M10.7's much larger
change where it would be expensive to bisect.

TLS backend is native-tls, NOT rustls, and that is the whole point of the
choice: on x86_64-pc-windows-msvc native-tls resolves to `schannel`, which
is pure-Rust bindings to the OS TLS stack, so nothing C or assembly has to
cross-compile on the fragile lane. rustls would pull in ring/aws-lc-rs and
their assembler. On Linux native-tls uses OpenSSL, whose headers ci-tauri
already ships (libssl-dev, part of Tauri's own Linux prerequisites).

Verified from run 2884's log rather than assumed: tokio and http are already
in the Windows tree via tauri, but no HTTP client and no TLS stack were —
so this genuinely is new surface there, not a no-op.

probe() distinguishes "never got a usable answer" (Err) from "answered, but
we can't work with it" (Ok + verdict). Those need very different messages:
one is "check what you typed", the other is "update something". Transport
errors are translated out of reqwest's Display, which is accurate but reads
like a stack trace.

Still no UI — M10.7 owns the link/settings surface that calls server_probe.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/src-tauri/Cargo.toml

@@ -28,6 +28,16 @@ chrono = { version = "0.4", default-features = false, features = ["clock"] }
 # issues are diagnosable from any environment. `log` is the facade the code uses.
 tauri-plugin-log = "2"
 log = "0.4"
+# HTTP for the opt-in server handshake (M10.6) and, next, the sync engine (M10.7).
+#
+# native-tls, NOT rustls, deliberately: on x86_64-pc-windows-msvc native-tls
+# resolves to `schannel` — pure-Rust bindings to the OS TLS stack — so nothing C or
+# assembly has to cross-compile on the Windows lane, which is the fragile one (it
+# builds on Linux via cargo-xwin, and a C dependency there is what broke it before).
+# rustls would instead pull in ring/aws-lc-rs and their assembler. On Linux
+# native-tls uses OpenSSL, whose headers (libssl-dev) ci-tauri already ships.
+# default-features off drops http2/charset we don't need for a JSON API.
+reqwest = { version = "0.12", default-features = false, features = ["json", "native-tls"] }
 
 # Tauri's default release profile: smaller, faster shipped binaries.
 [profile.release]