refactor(src): introduce AppError pattern, migrate security commands

[saagpatel]

Summary

Pilot for ADR 0012 — Tauri command error-type standardization.

The AppError infrastructure in src-tauri/src/error.rs (stable error codes, categories, retryable flag, From impls for rusqlite / io / validation / security errors) was fully built but zero commands used it. All 324 command signatures were on Result<T, String> with manual .map_err(|e| e.to_string()) at every error site.

This PR establishes the migration pattern without a frontend flag day.

The pattern

1. AppError now serializes as its Display form ("[CODE] message") via a custom impl Serialize using serializer.collect_str. The #[derive(Serialize, Deserialize)] was removed in favor of the explicit impl. Frontend ${err} / showError(...) handlers keep working — they receive strings, now with a stable [CODE] prefix they can branch on.
2. security_commands.rs + its 14 #[tauri::command] wrappers in commands/mod.rs + the shared normalize_github_host helper are migrated from Result<T, String> to Result<T, AppError>.
3. Cross-domain bridging. One still-unmigrated caller (ingest_github_remote at mod.rs:3733) calls the migrated helper through .map_err(|e| e.to_string())?. These bridges disappear automatically as each enclosing function migrates in future PRs.

The runway

ADR 0012 captures:

• The full migration recipe (6 steps per file)
• File-by-file runway for the remaining 13 command files, sorted smallest-first
• Reproducible grep commands to track progress

Target cadence: one file per PR, admin-merge since each migration is a pure refactor with tests green.

Test plan

• cargo check --all-targets — clean
• cargo test --lib — 311/312 pass (one pre-existing #[ignore]-gated model-download test)
• Sampled 100+ frontend error-handling sites and 13 toThrow(...) assertions — all compatible with the string wire format (the toThrow calls are against mocks, not wire errors)
• CI backend-tests green
• CI build green
• Smoke: Settings → HuggingFace/Search API/GitHub token set/clear produce the same success/error UX

🤖 Generated with Claude Code