fix(windows): survive wrong-identity installs — de-elevated MSI launch + access-denied Explorer fallback

[BrianLeishman]

The bug

Two IAP users hit stat "\\\\storage\\...": CreateFile \\storage\...: Access is denied. on storage folders they could open manually in Explorer without issue — and only on some shares (AACC / U.S. DOD Coins / CCN failed, Plus worked).

Root cause

The per-machine MSI's LaunchApp custom action runs in the elevated execute sequence, so after an install/upgrade the server keeps the installer's identity — the admin account typed at the UAC prompt, or an IT remote-assist session. SMB auth to \\storage then happens as that account, whose per-share permissions differ from the signed-in user's. Broadly-permissioned shares kept working; restricted ones denied. Manual Explorer navigation (as the real user) worked, which is exactly the reported symptom.

Fixes

• MSI: LaunchApp now launches via [WindowsFolder]explorer.exe "...folder-opener.exe". Explorer hands the launch to the session shell, so the server always starts as the actual desktop user. Session-less contexts (GPO machine install at boot) remain a no-op with the HKLM Run value picking it up at first login, as before.
• Windows resilience: when os.Stat fails with ERROR_ACCESS_DENIED, hand the path to Explorer anyway — Explorer runs as the desktop user, so the folder still opens with their permissions (and if even they lack access, Explorer shows its native permission dialog). FindFirstFile (which needs only parent-list rights) distinguishes dir vs file; an unknown type is revealed with /select rather than opened, so a localhost caller can never make the server execute a file it can't even stat.
• New access_denied error code (HTTP 403) on POST /open + the npm client's ErrorCode union, so web clients can show actionable help instead of the raw Go error.

Verification

• go build ./... && go vet ./... && go test ./... green, plus GOOS=windows and GOOS=linux CGO_ENABLED=0 cross-builds
• New unix test pins the permission-denied → access_denied mapping without invoking a real file browser
• npm client builds (npm run build)
• Note: CI doesn't compile the MSI on PRs — the wxs change gets exercised by the release build; worth a spot-check install of the v0.2.3 MSI

🤖 Generated with Claude Code