feat(desktop): add guided setup and local service management

[tulayha]

Summary

• let Desktop adopt or manage a VidXP installation and configure the complete selected feature set, including search capabilities, local processing, browser, MCP, and API service extras
• require the feature/service inventory contract before showing setup state; older selected uv installations get a product-facing in-place update path using the release manifest instead of misleading unchecked options
• expose product-facing readiness, MCP configuration, worker lifecycle, API lifecycle, and browser/API LAN-sharing controls with ports and connection URLs
• show readiness in a dedicated progress dialog with elapsed time, the search features actually checked, and named package/runtime/model results
• keep all launched commands inside the centralized supervised process runner, including Windows no-console and whole-process-tree ownership
• project the selected installation and supervised browser, processing, and app-service state into a concise tray menu with contextual start, share, stop, URLs, and update-required status

Why

The Desktop app primarily acted as a browser shim and exposed package/runtime concepts using developer-oriented names. Existing installations also could not change the same optional features as Desktop-managed installations, and the existing worker, doctor, MCP, API, and --share primitives were not represented in the product flow.

During upgrade testing, an older probe omitted the inventory fields introduced by this change. Desktop deserialized those missing fields as empty collections, making a working legacy browser look disabled in Setup options and making unknown search state look like no installed features. The compatibility gate now distinguishes a missing management contract from a genuinely empty inventory and offers an explicit update of the same external uv-tool environment. Package versions continue to come only from the release manifest; Release Please remains the version owner.

User impact

Users can choose an existing isolated uv-tool installation or a Desktop-managed runtime, add or remove supported features, check whether the installation is usable, configure an AI assistant, and start or stop local processing and integration services. Older saved uv installations are no longer represented using fabricated empty state: the app explains that an update is required and opens the feature selection with normal defaults before updating that same installation. Browser and API sharing remain explicit: browser sharing warns that it is unauthenticated, while API/MCP sharing presents the bearer token and resolved LAN addresses.

The system tray now shows the active installation state and concise service submenus. It preserves Open VidXP as the primary action, exposes only valid start/share/stop controls, includes the running browser or app-service URL, and keeps setup, readiness, tokens, and MCP configuration in Manage VidXP. Tray actions reuse the same supervised commands as the main window and never open a terminal.

Readiness now explains that it checks FFmpeg, installed packages, runtime imports, and downloaded models. While the existing JSON CLI contract runs, the app shows elapsed time and its expected scope; after completion it names the returned modalities and every check rather than showing an unexplained spinner or a generic green result.

Release channels

The existing release contract continues to classify beta and stable builds and pins the matching Python runtime in the bundled manifest. This PR does not introduce an automatic Desktop updater or a fake channel preference; update-channel enrollment belongs with the signed updater work.

Validation

• isolated uv tool install from the working tree with local-worker, frontend, mcp, and server extras — installed all six executables without touching the user's installation
• real Windows Desktop probe against that isolated tool — accepted; reported actor, dialogue, scene, browser, worker, MCP, and server
• isolated doctor --modalities actor,dialogue,scene --json against the configured local data — passed all 32 package, runtime, model, storage, and media checks
• uv run ruff check src tests — passed
• uv run pytest tests/test_local_probe.py -q — 10 passed, 1 skipped
• prior targeted Python suite for the full PR — 94 passed, 1 skipped
• cargo fmt --check — passed
• cargo check and cargo clippy --all-targets -- -D warnings — passed
• cargo test --locked --lib on Windows — 77 passed
• npm run check — typecheck, lint, 36 tests, and production build passed
• uv run python utils/release_contract.py --channel beta — passed with all version sources unchanged
• git diff --check — passed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c9503ceaeb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pass selected modalities to the readiness check

When the selected installation only has a subset of search features enabled (for example dialogue-only, MCP-only, or any external setup changed via Setup options), this runs vidxp doctor --json without --modalities, and the CLI defaults to checking every registered capability. The Desktop readiness panel will therefore report missing packages/models for actor or scene even though those features are not part of profile.capabilities; scope the doctor command to the selected profile's capabilities (and handle the empty case) so the check matches the installation being reviewed.

Useful? React with 👍 / 👎.