[Deps]: Replace localtunnel (abandonware since 2022) with a maintained alternative

[matiaspalmac]

Describe the dependency issue

localtunnel@2.0.2 is declared in apps/desktop/package.json:30 and spawned via pnpm lt from apps/desktop/src-tauri/src/tunnel.rs:101-169. Issues:

1. The package has had no release since 2022 — it is effectively abandonware and its transitive axios has open CVEs.
2. It is under dependencies (not devDependencies), even though it is a Node-only runtime and never executes in the browser. Next.js still tries to resolve it for the client bundle and emits warnings about missing net/tls/http polyfills.
3. The tunnel has no authentication and no TLS.

Proposed change:

Evaluate replacing localtunnel with a maintained alternative (cloudflared, ngrok with token, or a Rust crate such as tunneler). Move the dependency out of the browser bundle either way.

Would you like to submit a PR for this dependency update?

Maybe