fix: harden v2.3.1 release

[ZihangDong]

Summary

• disable production DevTools and F12 paths
• harden local services, external navigation, path handling, Markdown, network response limits, and MCP input handling
• remove unsupported matting models and fix model download concurrency
• migrate AI credentials to Windows DPAPI storage
• stage generated CLI resources in clean checkouts and enforce the staging/import contract
• bump desktop and CLI release metadata to v2.3.1

Verification

• npm run test:release (61/61 suites; 442 security release checks)
• Rust tests: 92 passed, 1 ignored manual LibreOffice QA
• cargo clippy --locked --all-targets
• npm audit: 0 vulnerabilities for desktop and CLI
• cargo audit: no vulnerabilities, unsound dependencies, or yanked crates
• production NSIS bundle built and runtime-checked with DevTools shortcuts disabled