feat: rebuild desktop sync as linked server accounts, fix packaged plugin bundles and UI scaling

scripts/electron-security-boundary.test.ts

@@ -19,8 +19,22 @@ describe("Electron security boundary", () => {
     );
   });
 
-  it("allows the renderer to hand the local session to Remote Sync", () => {
-    expect(main).toContain('ipcMain.handle("notify-local-login"');
-    expect(preload).toContain('"notify-local-login"');
+  it("never hands the linked server's session to the renderer over IPC", () => {
+    // The embedded backend owns the link; the renderer asks it, with its
+    // own local session, rather than main.
+    for (const channel of [
+      "get-remote-sync-jwt",
+      "save-remote-sync-jwt",
+      "notify-local-login",
+    ]) {
+      expect(main).not.toContain(`"${channel}"`);
+      expect(preload).not.toContain(`"${channel}"`);
+    }
+  });
+
+  it("scopes proxy headers and basic auth to the linked origin", () => {
+    expect(main).toContain('"sync-proxy-config"');
+    expect(main).toContain("linkedServer.applyLinkHeaders(");
+    expect(main).toContain("linkedServer.answerLogin(");
   });
 });