desktop: a global hotkey opens a small window to write in, now with its lockfile

Restores 42e06da, which was reverted only because Cargo.lock had not been
updated for the new crate and every cargo invocation in CI passes `--locked`.
Both desktop jobs failed on that line before compiling anything, so nothing
about the code had been judged.

The lockfile was generated in CI's own `ci-tauri:1.97` image — one container,
`cargo fetch`, nothing built. `cargo fetch` and NOT `generate-lockfile`: the
latter re-resolves from scratch and would have churned versions across the
whole workspace to add one dependency. The diff is 67 insertions, zero
deletions, six packages — tauri-plugin-global-shortcut plus global-hotkey,
x11rb, x11rb-protocol, xkeysym and gethostname. Nothing existing moved.

The feature itself, unchanged from 42e06da:

Press the combination anywhere and a small window arrives over whatever you
were doing; type, Ctrl/Cmd+Enter, gone. The board never comes forward.

There is no default shortcut on purpose — any default is a key combination
taken away from something else on somebody's machine, silently, at install
time. CommandOrControl+Shift+N is offered as a one-click suggestion.

Stored and live are separate fields because they disagree: a combination
another app holds is saved and does nothing when pressed, and a Wayland
compositor may refuse global grabs outright. `capture_shortcut_set` registers
before storing, so a refused combination is never written down as if it worked.

The window hides rather than closes and keeps its text, so an interrupted
capture is still there next press — which is what makes Escape safe. A failed
save keeps it open too, rather than discarding the only copy of something just
written in order to report a retryable problem.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3MMqUtzX1TJgA1oypvm1c

frontend/src/router/index.ts

@@ -24,6 +24,15 @@ const router = createRouter({
         { path: "timeline", name: "timeline", component: () => import("../views/TimelineView.vue") },
       ],
     },
+    {
+      // The quick-capture window (#1899). Its own route because it is its own
+      // WINDOW — no shell, no nav, one field. Desktop only: there is no global
+      // hotkey in a browser tab and nothing to summon it.
+      path: "/capture",
+      name: "capture",
+      component: () => import("../views/CaptureView.vue"),
+      meta: { requiresAuth: true, requiresDesktop: true },
+    },
     {
       path: "/settings",
       name: "settings",
@@ -89,6 +98,13 @@ router.beforeEach(async (to) => {
   if (to.meta.requiresDesktop && !isDesktop()) {
     return { name: "board" };
   }
+  // The capture window is opened at `index.html?capture=1` rather than at
+  // `/capture`, because the bundled assets are served as files and a path with no
+  // file behind it 404s in the production build — it only routes under the dev
+  // server. A query string survives that, and this is where it becomes a route.
+  if (to.query.capture === "1" && to.name !== "capture") {
+    return { name: "capture" };
+  }
   // Deliberately NOT applied to /login and /register: bouncing those on desktop
   // would loop against the requiresAuth guard above the moment a session is
   // missing. Nothing on the desktop navigates to them any more (AppShell's sign-out