M10.7e: desktop Sync settings screen (task 2108)

The surface that turns the engine into a feature (rule 27). Desktop-only —
the web build IS a server's UI, so a "connect a server" screen there would be
nonsense; the route redirects to the board and the nav entry is hidden.

UNLINKED IS THE RESTING STATE, not an incomplete setup. The empty case leads
with "Working offline on this device — everything works without a server",
because a screen that framed the default as a problem would push people into
configuring something they may never need. The app is local-first; this is
opt-in.

Probe before credentials. "Check" shows who actually answered — site name,
version, and the M10.6 verdict — before any password or token is typed. An
incompatible server is shown in red and the sign-in fields never appear, so
you cannot hand a credential to something that can't use it. `degraded` names
the missing capabilities rather than staying quiet and letting a feature
mysteriously do nothing.

Both credential paths, matching the Rust side: email+password (a fresh
install has no session to mint a token from) or a pasted device token (for
anyone who'd rather not type a password into a desktop app). Secrets are
cleared from component state the moment they're exchanged.

Disconnect states plainly that the token stays valid server-side and points
at Account -> Linked devices, rather than implying a remote revoke that
didn't happen (issue 2110). Wording avoids "revoke" for exactly that reason.

Push rejections are surfaced verbatim after a sync, never swallowed — a
duplicate label name is the realistic case and only a person can resolve it.

Adds schema v3: last_sync_at. The cursor can't answer "am I up to date?" —
it's a revision watermark, not a time, and it doesn't move at all when a sync
legitimately finds nothing new, so "synced a moment ago, nothing new" would
be indistinguishable from "never synced". Stamped only after BOTH halves of
the cycle succeed; a stamp after a partial cycle would claim currency the
data doesn't have. Cleared on unlink so a new server can't inherit it.

run_cycle now returns the post-cycle status, so the UI updates from one
round-trip instead of chasing every sync with a status call.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi

frontend/src/desktop/bridge.ts

@@ -47,3 +47,100 @@ export const desktop = {
   integrate: () => invoke<IntegrationStatus>("integrate_desktop"),
   unintegrate: () => invoke<IntegrationStatus>("unintegrate_desktop"),
 };
+
+// --- opt-in server sync (M10.7) ----------------------------------------------
+// The desktop app is local-first: none of this runs unless the user links a server,
+// and the app is fully usable having never done so.
+
+/** Never carries the device token — that stays on the Rust side, out of the webview. */
+export interface SyncStatus {
+  linked: boolean;
+  server_url: string | null;
+  last_cursor: number;
+  last_sync_at: string | null;
+}
+
+export interface ServerInfo {
+  site_name: string | null;
+  version: string | null;
+  sync_protocol_version: number | null;
+  min_client_protocol_version: number | null;
+  sync_features: string[];
+}
+
+/**
+ * The M10.6 handshake verdict. `incompatible` carries `client_must_update` so the
+ * message can name which side has to change rather than just saying "incompatible".
+ */
+export type Compatibility =
+  | { status: "ok" }
+  | { status: "degraded"; unavailable: string[] }
+  | { status: "incompatible"; reason: string; client_must_update: boolean };
+
+export interface ProbeResult {
+  base_url: string;
+  server: ServerInfo;
+  compatibility: Compatibility;
+}
+
+export interface Identity {
+  id: string;
+  email: string;
+  display_name: string;
+}
+
+export interface LinkResult {
+  status: SyncStatus;
+  identity: Identity;
+  compatibility: Compatibility;
+}
+
+export interface PushSummary {
+  batches: number;
+  sent: number;
+  created: number;
+  applied: number;
+  kept: number;
+  noop: number;
+  rejected: number;
+  errors: string[];
+}
+
+export interface PullSummary {
+  pages: number;
+  notes_applied: number;
+  notes_deleted: number;
+  labels_applied: number;
+  labels_deleted: number;
+  cursor: number;
+  clobbered_dirty: number;
+}
+
+export interface SyncOutcome {
+  push: PushSummary;
+  pull: PullSummary;
+  status: SyncStatus;
+}
+
+/** Either a password login or a token pasted from the web app's Linked devices. */
+export interface LinkInput {
+  url: string;
+  email?: string;
+  password?: string;
+  token?: string;
+  name?: string;
+}
+
+export const sync = {
+  /** Ask who's at an address without committing to anything. */
+  probe: (url: string) => invoke<ProbeResult>("sync_probe", { url }),
+  link: (input: LinkInput) => invoke<LinkResult>("sync_link", { input }),
+  unlink: () => invoke<SyncStatus>("sync_unlink"),
+  status: () => invoke<SyncStatus>("sync_status"),
+  /**
+   * One full cycle: push, then pull. There is deliberately no bare "pull" — pulling
+   * without pushing first overwrites unsent local edits.
+   */
+  now: () => invoke<SyncOutcome>("sync_now"),
+  hasPending: () => invoke<boolean>("sync_has_pending"),
+};