CE: Stable desktop download redirect routes

[ericflo]

What

Adds /download/desktop/{platform} routes that resolve to the latest desktop release via the GitHub API, with a 5-minute in-process cache and a graceful fallback to the releases landing page. Updates the landing page download tiles to use these stable paths instead of hardcoded desktop-v0.1.1 filenames.

Supported platform slugs:

• /download/desktop/macos → *_aarch64.dmg
• /download/desktop/macos-intel → *_x64.dmg
• /download/desktop/linux (and /download/desktop/linux-deb) → *_amd64.deb
• /download/desktop/windows → *_x64-setup.exe

Unknown platforms or GitHub API failures redirect to https://github.com/ericflo/modelrelay/releases/latest so links never 404.

Why

The landing page hardcoded desktop-v0.1.1 filenames in three <a> tags, so every desktop release otherwise required a code change to keep the tiles working. This eliminates that recurring chore and protects against the releases/latest cross-stream gotcha (CLI vs desktop tags) noted in past incidents.

Notes

• Implementation lives in crates/modelrelay-cloud/src/routes/mod.rs (~80 LOC including the cache plumbing).
• Cache is a LazyLock<RwLock<Option<(Instant, HashMap<String, String>)>>> aliased to DesktopAssetCache to satisfy clippy::type_complexity.
• New SESSION_EXEMPT_PREFIXES const lets path-parameterised routes skip the session guard without each variant needing its own entry.
• Tests: unit tests for the platform→suffix mapping, plus an integration test that verifies an unknown platform redirects to the releases landing page (no network).