[cbhandsun]

What changed

• hardened proxy input validation, logging, retry boundaries, UI persistence, and CI verification
• split the oversized proxy entry into a composition root with dedicated request, lifecycle, runtime, and observability modules
• added reproducible Tauri and portable packaging with a production-only bundled runtime
• added release artifact collection, SHA-256 manifests, and sensitive-file validation

Why

The proxy entry had accumulated request handling and lifecycle responsibilities, while release packaging could reuse local state and was difficult to reproduce safely. This change makes runtime boundaries independently testable and ensures distributed packages are stateless.

Impact

• source users only need to restart the proxy
• packaged desktop users receive a rebuilt NSIS installer or portable ZIP
• release packages no longer include local configuration, credentials, logs, certificates, or management tokens

Validation

• npm run verify
• npm run tauri:build
• portable package validation: 682 ZIP entries, 0 forbidden state/secret entries
• Tauri installer and portable ZIP SHA-256 hashes generated