* fix(core): restore URL pathname before next() in middleware — fixes auth on Netlify

registerMiddleware strips event.url.pathname for path-matched handlers
(e.g. the readiness gate at /_agent-native). Previously, the original
pathname was restored in a finally block that runs AFTER next() returns.
By that time, all downstream middleware has already executed with the
stripped path. The auth guard reads event.path (derived from
event.url.pathname in h3 v2) and fails to recognize /_agent-native/auth/*
routes, returning login HTML instead of dispatching to the session/login
handlers. This broke sign-in on all Netlify-deployed templates.

Fix: restore the pathname BEFORE calling next() when the handler returns
undefined (fall-through), matching h3 v2's own sub-app middleware
pattern. The finally block still covers the error-path restore.

* fix(clips-desktop): add Windows icon.ico for Tauri build

The Windows Tauri build requires icons/icon.ico to generate the Windows
Resource file. Generated from the existing icon.png with 16/32/48/64/
128/256px sizes embedded.

* feat(clips): require file upload provider + MP4 faststart streaming

- Add required onboarding step for video storage (Builder.io one-click
  or S3-compatible: AWS S3, Cloudflare R2, DigitalOcean Spaces, etc.)
- Create S3-compatible file upload provider with SigV4 signing (no SDK)
- Add pure-TypeScript MP4 faststart: relocates moov atom before mdat so
  browsers can start playback immediately via HTTP range requests
- Flip MediaRecorder codec preference to MP4 (H.264) first — Chrome 121+
  and Safari produce MP4 natively, Firefox falls back to WebM
- Remove application_state blob fallback — videos must go to a real
  storage provider (Builder.io or S3)
- Guard recording start: check file upload status before allowing record

* fix(core): embed pnpm catalog in published package — fixes scaffold install

loadCatalog() resolved the catalog from the monorepo pnpm-workspace.yaml
via a relative __dirname path, which doesn't exist when running as a
published npm package via npx. Templates using catalog: version refs
(all of them) would fail with ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC.

Now the build step snapshots the catalog into dist/catalog.json, and
loadCatalog() reads it first before falling back to the monorepo file.

* fix(clips-desktop): fix Windows build — gate macOS-only RunEvent::Reopen

RunEvent::Reopen only exists on macOS. Gate it with #[cfg(target_os)]
so Windows compiles. Also suppress unused_mut warnings on builder
variables that are only mutated inside macOS cfg blocks.