Desktop quality pass: hot-path perf, hands-free races, Windows compatibility

[metaforismo]

Multi-reviewer quality pass over the merged desktop code (3 review agents: performance, Windows compatibility, recent-feature correctness), with every applied fix verified against the code first.

Performance (per-dictation hot path)

• text-writer: the clipboard restore ran a thread::sleep(1s) on the main thread of the one-shot binary (the comment claimed a background thread) — every dictation held the "processing" pill ~1s longer. The binary now pastes and exits; the Electron main process restores the user's clipboard on a timer, with correct handling of back-to-back dictations (Windows writer had the same bug — also fixed).
• key events: every OS keystroke was broadcast over IPC to all renderer windows, always (2 msgs/keystroke/window, plus a privacy surface). Forwarding is now opt-in per webContents, toggled by the preload around onKeyEvent — only the shortcut editors receive events, only while mounted.
• interactions list: findAll shipped the raw_audio BLOB for every row over IPC on every dictation. The list now uses a summary query (has_audio flag) and the renderer fetches audio lazily by id for play/download.
• audio: volume-meter RMS+emit throttled to ~15Hz at the source (was ~47/s); awaitDrainComplete no longer orphans the first caller and leaks error listeners on overlapping stops.

Hands-free state machine (follow-up to #62 / 434df45)

• Toggling hands-free off mid-session no longer orphans the recording: pending taps settle, an active hands-free session completes on the next key event, and a still-held double-tap downgrades to push-to-talk.
• Stop→start serialization: a pending tap interrupted by a different shortcut issued completeSession() + startSession() in the same tick, and the new session's initialize() could interleave with the old session's teardown (dropping the audio-duration check or cancelling the new stream). startSession now waits for the in-flight stop's teardown phase (released before the server-response wait, so no added latency).
• An accidental double-tap on the hands-free stop tap no longer starts a spurious sub-400ms recording ("No speech detected" toast).
• Globally disabling dictation now cancels the in-flight session instead of completing it (no surprise text insertion); removed dead activeShortcutId assignments.

Windows compatibility

• Ctrl+V / Ctrl+C with raw virtual keys (VK_V/VK_C) instead of Key::Unicode: on layouts without v/c keys (Cyrillic, Greek, …) enigo fell back to sending text, the chord was never delivered, and paste/copy — the app's core function — silently failed.
• Unknown(179) is only the fn key on macOS; on Windows it's media Play/Pause and was corrupting the pressed-keys set (gated in Rust and TS).
• Mic privacy: checkMicrophonePermission hardcoded true on Windows; it now reads getMediaAccessStatus, so a denied mic no longer passes onboarding and records silence.
• Packaging: local cross-compile (GNU) now mirrors .exes into the MSVC target dir that electron-builder and the dev resolver expect — bun build:app:windows produced a broken layout before.
• Closing the dashboard on Windows hides to tray (like macOS) instead of quitting the whole app mid-dictation; Quit stays in the tray menu.
• The macOS-only "Mute audio when dictating" toggle is hidden on other platforms (was a silent no-op).

Tests

• +7 regression tests for the new behaviors (forwarding gate, refractory window, toggle-off reconciliation, Esc-during-pending, stop-with-pending-tap, stop→start barrier).
• Full suite green: lib (incl. keyboard 55, session manager 31), server, app, native (cargo test --workspace), clippy clean, and cargo check --target x86_64-pc-windows-gnu passes for the three changed crates.

🤖 Generated with Claude Code