desktop: remove two dead ends from the shell, and stop the launch flash (task 1999)

Sign out was a trap on the desktop, not an action. It nulls the synthetic local
user and redirects to /login, but the offline adapter rejects every sign-in with
"there's no account to sign in to" — so the only way back into your own notes was
to restart the app. There is nothing to sign out of; the notes are on this
machine either way.

Linked devices was a quieter version of the same thing: it lists the tokens a
SERVER has issued to native clients, and the desktop is one of those clients, so
offline the list is always empty and issuing a token rejects. Its actual
relationship with a server already has a home at /sync. Also hid the account
name, which named a login the app doesn't have.

/account is now blocked in the router too, not merely hidden — the mirror of the
existing requiresDesktop guard — so a typed URL or a restored history entry
can't reach the dead end either. Deliberately not applied to /login and
/register: bouncing those on desktop would loop against the requiresAuth guard
whenever a session is missing.

The launch flash is the window painting before the webview does, showing the
platform default white through the gap — worst on a dark-mode desktop, and
widened by the software rendering we force on Linux. Set from the live system
theme rather than app.windows[].backgroundColor, because that config carries one
static colour and either choice would fix half of users while introducing the
same flash for the other half.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

frontend/src/components/AppShell.vue

@@ -260,9 +260,15 @@ async function signOut() {
           >
             <Icon name="plus" /> <span class="hidden sm:inline">New</span>
           </button>
-          <span class="hidden text-sm text-neutral-500 md:inline dark:text-neutral-400">{{
-            session.user?.display_name
-          }}</span>
+          <!-- Whose account this is only means something when there IS an account.
+               The desktop signs in as a synthetic local user so the shared router's
+               auth guard resolves; naming it would invent a login the app doesn't
+               have. -->
+          <span
+            v-if="!desktopApp"
+            class="hidden text-sm text-neutral-500 md:inline dark:text-neutral-400"
+            >{{ session.user?.display_name }}</span
+          >
           <RouterLink
             v-if="desktopApp"
             to="/sync"
@@ -272,7 +278,17 @@ async function signOut() {
           >
             <Icon name="sync" />
           </RouterLink>
-          <RouterLink to="/account" class="icon-btn" title="Linked devices" aria-label="Linked devices">
+          <!-- Server-side concept: it lists the tokens a server has issued to native
+               clients. The desktop IS one of those clients, so here the list is always
+               empty and issuing a token rejects — its own relationship with a server
+               lives under /sync instead. -->
+          <RouterLink
+            v-if="!desktopApp"
+            to="/account"
+            class="icon-btn"
+            title="Linked devices"
+            aria-label="Linked devices"
+          >
             <Icon name="device" />
           </RouterLink>
           <RouterLink
@@ -284,7 +300,19 @@ async function signOut() {
           >
             <Icon name="settings" />
           </RouterLink>
-          <button type="button" class="icon-btn" title="Sign out" aria-label="Sign out" @click="signOut">
+          <!-- Hidden on the desktop, where it was a trap rather than an action:
+               logout nulls the synthetic local user and redirects to /login, but the
+               offline adapter rejects every sign-in ("there's no account to sign in
+               to"), leaving no way back in short of restarting the app. There is
+               nothing to sign out OF — the notes are on this machine either way. -->
+          <button
+            v-if="!desktopApp"
+            type="button"
+            class="icon-btn"
+            title="Sign out"
+            aria-label="Sign out"
+            @click="signOut"
+          >
             <Icon name="logout" />
           </button>
         </div>

frontend/src/router/index.ts

@@ -42,10 +42,16 @@ const router = createRouter({
     },
     {
       // Per-user account: linked devices (native-client sync tokens). Any user.
+      //
+      // The mirror of `requiresDesktop` above: this one needs a SERVER. The desktop
+      // is itself one of the devices this page lists, so offline the list is always
+      // empty and issuing a token rejects — its server relationship lives at /sync.
+      // Guarded in the router, not just hidden in the shell, so a typed URL or a
+      // restored history entry can't land on a dead end either.
       path: "/account",
       name: "account",
       component: () => import("../views/AccountView.vue"),
-      meta: { requiresAuth: true },
+      meta: { requiresAuth: true, requiresServer: true },
     },
     {
       path: "/login",
@@ -85,6 +91,13 @@ router.beforeEach(async (to) => {
   if (to.meta.requiresDesktop && !isDesktop()) {
     return { name: "board" };
   }
+  // Deliberately NOT applied to /login and /register: bouncing those on desktop
+  // would loop against the requiresAuth guard above the moment a session is
+  // missing. Nothing on the desktop navigates to them any more (AppShell's sign-out
+  // is web-only), and a fresh launch always resolves the local user.
+  if (to.meta.requiresServer && isDesktop()) {
+    return { name: "board" };
+  }
   if (to.name === "register" && !config.allowRegistration) {
     return { name: "login" };
   }