desktop: robust startup + operation logging (portability troubleshooting)

There was essentially no logging — useless for proving the app renders across
different environments. Add real observability:

- tauri-plugin-log -> stdout (so `2>&1 | tee` captures a run) AND a persistent
  file in the app log dir (grabbable after the fact on any machine). Level Info.
- Startup diagnostics: app version, OS/arch, the Linux display/session stack
  (XDG_SESSION_TYPE, desktop, Wayland/X11, GDK_BACKEND), the WebKit render-
  hardening vars actually in effect, resolved log + data dirs, DB open/migrate
  result, and note/label counts.
- log_event command + a frontend logEvent() helper: boot line (data source +
  WebKit user-agent) from main.ts, first-route config/session/destination from
  the router guard, and — via the bridge invoke() wrapper — every failed Tauri
  command named with its error, so a broken basic function is self-identifying.

Task 2040.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/router/index.ts

@@ -1,6 +1,11 @@
 import { createRouter, createWebHistory } from "vue-router";
 import { useSessionStore } from "../stores/session";
 import { useConfigStore } from "../stores/config";
+import { logEvent } from "../desktop/bridge";
+
+// One-time boot diagnostic: the first navigation is where config + session resolve,
+// so it's the moment that tells us whether the app got past its startup gate.
+let bootLogged = false;
 
 const router = createRouter({
   history: createWebHistory(),
@@ -56,6 +61,13 @@ router.beforeEach(async (to) => {
   if (!session.loaded) {
     await session.fetchMe();
   }
+  if (!bootLogged) {
+    bootLogged = true;
+    logEvent(
+      "info",
+      `first route: config(site=${config.siteName}) session(user=${session.user?.email ?? "none"}) -> ${String(to.name ?? to.path)}`,
+    );
+  }
   if (to.meta.requiresAuth && !session.user) {
     return { name: "login", query: to.fullPath !== "/" ? { redirect: to.fullPath } : undefined };
   }