* fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie
open-external-editor now launches only the editor saved from a file dialog
and refuses to hand executable file types to the OS opener. The unused
get-session-cookie and wait-session-cookie channels, which returned the
httpOnly jwt, are removed.
* fix: validate setting keys before editor authorization
