M10.6: HTTP transport for the handshake (task 1995)

Adds the client's first outbound call: GET {server}/api/config, carrying
X-ThoughtSync-Client and X-ThoughtSync-Protocol, feeding compat::evaluate.

Deliberately its OWN commit. This introduces the first HTTP+TLS stack into a
crate that cross-compiles to Windows from Linux via cargo-xwin — the lane
that has already broken once on a transitive C dependency (libsqlite3-sys
needing llvm-lib). Landing it alone means a failure here has exactly one
possible cause, instead of surfacing mid-way through M10.7's much larger
change where it would be expensive to bisect.

TLS backend is native-tls, NOT rustls, and that is the whole point of the
choice: on x86_64-pc-windows-msvc native-tls resolves to `schannel`, which
is pure-Rust bindings to the OS TLS stack, so nothing C or assembly has to
cross-compile on the fragile lane. rustls would pull in ring/aws-lc-rs and
their assembler. On Linux native-tls uses OpenSSL, whose headers ci-tauri
already ships (libssl-dev, part of Tauri's own Linux prerequisites).

Verified from run 2884's log rather than assumed: tokio and http are already
in the Windows tree via tauri, but no HTTP client and no TLS stack were —
so this genuinely is new surface there, not a no-op.

probe() distinguishes "never got a usable answer" (Err) from "answered, but
we can't work with it" (Ok + verdict). Those need very different messages:
one is "check what you typed", the other is "update something". Transport
errors are translated out of reqwest's Display, which is accurate but reads
like a stack trace.

Still no UI — M10.7 owns the link/settings surface that calls server_probe.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

desktop/src-tauri/src/lib.rs

@@ -8,8 +8,9 @@
 
 mod integration;
 mod local;
-// `pub` (unlike the modules above) because nothing calls into it yet — the sync
-// engine that will is M10.7. A private module's unused items read as dead code.
+// `pub` (unlike the modules above) because most of it has no in-crate caller yet —
+// the sync engine that will consume it is M10.7, and a private module's unreachable
+// items read as dead code.
 pub mod sync;
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
@@ -88,6 +89,7 @@ pub fn run() {
             local::commands::saved_filters_create,
             local::commands::saved_filters_remove,
             local::commands::saved_filters_rename,
+            sync::client::server_probe,
         ])
         .run(tauri::generate_context!())
         .expect("error while running the ThoughtSync desktop app");