merge: integrate main into dev

Resolve 9 merge conflicts preserving both sides' intent:
- nix hash, bootstrap hostnames rename, websocket-server wiring
- session.ts handler dedup, snapshot fallback, worktree registration
- worktree-session git service + script/setup features
- sidebar-workspace-list setup navigation, session-context cleanup
- workspace-registry-bootstrap test kept (code still exists)
- checkout-git test additions from both sides

Post-merge fixes: isPaneFocused prop rename, server type rebuild.

packages/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getpaseo/desktop",
-  "version": "0.1.55-rc.2",
+  "version": "0.1.56",
   "private": true,
   "description": "Paseo desktop app (Electron wrapper)",
   "main": "dist/main.js",
@@ -8,12 +8,13 @@
     "build": "npm --prefix ../.. run build:daemon && npm run build:main && electron-builder --config electron-builder.yml",
     "build:main": "tsc -p tsconfig.json",
     "dev": "./scripts/dev.sh",
+    "dev:win": "powershell ./scripts/dev.ps1",
     "test": "vitest run",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@getpaseo/cli": "0.1.55-rc.2",
-    "@getpaseo/server": "0.1.55-rc.2",
+    "@getpaseo/cli": "0.1.56",
+    "@getpaseo/server": "0.1.56",
     "electron-log": "^5.4.3",
     "electron-updater": "^6.6.2",
     "ws": "^8.14.2"

packages/desktop/scripts/dev.ps1

@@ -0,0 +1,36 @@
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$DesktopDir = (Resolve-Path "$ScriptDir\..").Path
+$AppDir = (Resolve-Path "$DesktopDir\..\app").Path
+$RootDir = (Resolve-Path "$DesktopDir\..\..").Path
+
+# Build the Electron main process
+npm run build:main
+
+# Get a random available port for Metro
+$env:EXPO_PORT = (npx get-port-cli).Trim()
+
+# Set EXPO_DEV_URL in the environment so Electron inherits it
+$env:EXPO_DEV_URL = "http://localhost:$($env:EXPO_PORT)"
+
+# Allow any origin in dev so Electron on random ports works.
+# SECURITY: wildcard CORS is unsafe in production — only acceptable here because
+# the daemon binds to localhost and this script is never used for production.
+$env:PASEO_CORS_ORIGINS = "*"
+
+Write-Host @"
+======================================================
+  Paseo Desktop Dev (Windows)
+======================================================
+  Metro:     http://localhost:$($env:EXPO_PORT)
+======================================================
+"@
+
+# Launch Metro + Electron together, kill both on exit
+& "$RootDir\node_modules\.bin\concurrently" `
+    --kill-others `
+    --names "metro,electron" `
+    --prefix-colors "magenta,cyan" `
+    "cd `"$AppDir`" && npx expo start --port $($env:EXPO_PORT)" `
+    "npx wait-on tcp:$($env:EXPO_PORT) && npx electron `"$DesktopDir`""