Add Windows desktop packaging

[bigmacfive]

Summary

• add Windows desktop packaging config for Tauri NSIS/MSI bundles, Windows icons, and installer shortcut icon hooks
• add Windows release/prerequisite scripts plus a GitHub Actions workflow for Windows bundle builds
• add unsigned MSIX packaging support for Microsoft Store prep without committing store listing images
• adjust desktop UI shortcuts/updater behavior and landing page download links for Windows

Verification

• pnpm --filter @kuku/desktop build
• cargo check --locked -p kuku-app --all-targets
• pnpm --filter @kuku/web test -- prod_release
• powershell -NoProfile -ExecutionPolicy Bypass -File scripts\release-windows-store-msix.ps1 -SkipBuild

Notes

• Windows installers/MSIX are intentionally unsigned until a signing certificate or Partner Center signing path is chosen.
• Store package identity placeholders must be replaced with Partner Center values before final Store upload.

[bigmacfive]

A small macOS regression check would be useful before merging. Most of this PR is Windows-only packaging, but a few shared desktop code paths changed:

• apps/desktop/src/app.tsx: updater checks now run only when import.meta.env.PROD && isMacPlatform(). This should preserve the existing macOS updater behavior, but if platform detection failed on macOS, automatic update checks would be skipped.
• apps/desktop/src/lib/platform.ts: shortcut labels are preserved on macOS and converted to Windows-style labels elsewhere. If macOS detection failed, shortcut hints could incorrectly show Ctrl instead of ⌘.
• apps/desktop/src/components/layout/title_bar.tsx: the traffic-light spacer is now gated on macOS detection. If detection failed, the macOS titlebar spacing could look off.

I do not expect these to break normal macOS Tauri builds, but they are the shared-code areas worth smoke testing on macOS: launch the production app, confirm updater startup behavior, shortcut labels, and titlebar spacing.

[bigmacfive]

Follow-up fix for Windows desktop login callback:

Windows opens custom URL schemes by launching a new app process with the deep-link URL as a CLI argument. The auth flow keeps the pending state in the already-running app process, so the callback could be delivered to a fresh process and fail to update the original app session.

This branch now adds tauri-plugin-single-instance with the deep-link feature enabled, registered before the deep-link plugin. That lets Windows forward the kuku://auth?... launch arguments back into the existing app instance, where the pending auth state exists and the token exchange can complete.

Verified locally:

• cargo check --locked -p kuku-app --all-targets
• powershell -NoProfile -ExecutionPolicy Bypass -File scripts\release-windows.ps1 -SkipChecks
• confirmed the generated NSIS installer still registers kuku and com.kuku.app URL protocols.