feat(dev): support one-command Community Web and Desktop development

[AlcoholTobaccoCode]

Related issue

N/A - No approved Issue was provided.

Summary

Adds a one-command Community development workflow for Web and JCEF Desktop.

• Adds script/dev-community.sh to start the frontend with either the backend or JCEF Desktop.
• Binds the frontend and backend to 127.0.0.1:8889 and 127.0.0.1:10825.
• Loads the Umi development renderer from localhost in non-release Desktop development, while packaged builds continue using dist/index.html.
• Discovers compatible Java/JBR installations and can download, SHA-512 verify, and cache a pinned JBR 17 + JCEF runtime.
• Restricts JCEF bridge access to the trusted main-frame renderer origin.
• Adds the required CORS origins, regression coverage, Node version declarations, and synchronized EN/CN/ES/JA/KO documentation.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • bash -n script/dev-community.sh script/dev-community.test.sh script/jbr-runtime-manifest.sh script/package/package-community-jcef.sh - passed.
  • bash script/dev-community.test.sh - passed.
  • yarn run test:community-dev-loopback - passed.
  • yarn run lint - passed with zero warnings.
  • yarn run test:sql-in-clipboard - passed.
  • yarn run build:web:community --app_version=0.0.0 - passed with Node 20.20.2.
  • JCEF focused Maven tests - 14 tests, 0 failures, 0 errors.
  • CORS focused Maven test - 1 test, 0 failures, 0 errors.
  • JCEF/Web Maven package build - passed; tests were skipped for this packaging-only command.
  • script/package/package-community-jcef.sh 0.0.0-local prepare - all 48 Maven modules built and jpackage input staging completed; tests were skipped by the packaging script.
  • script/dev-community.sh web --dry-run - resolved the expected loopback frontend/backend commands.
  • CHAT2DB_JBR_DOWNLOAD=never script/dev-community.sh desktop --dry-run - resolved the verified JBR cache and expected Desktop command.
  • git diff --check - passed.
• Manual verification:
  • Completed a macOS arm64 fresh-clone Desktop startup smoke.
  • Confirmed the Community frontend, backend, and JCEF renderer start together.
  • Confirmed frontend source edits update both the browser and JCEF development renderer.
  • Linux and Windows native runtime/package verification remains platform/CI-only.
• UI evidence: N/A - this changes development tooling and renderer loading behavior, not product UI.

Risk and compatibility

• Public API or stored data: N/A - no public API contract, schema, migration, or storage format changed.
• Database or driver compatibility: N/A - no database plugin or driver behavior changed.
• Network, privacy, or security: Development listeners are restricted to loopback. CORS only adds the Community development origins on port 8889. JCEF bridge requests are rejected unless they originate from the trusted main frame. Downloaded JBR
  archives require HTTPS and a matching pinned SHA-512 checksum.
• Community / Local / Pro boundary: Community identity, offline network status, storage behavior, and runtime flags remain explicit. No Local, Pro, Enterprise Gateway, account, payment, or licensing behavior was introduced.
• Backward compatibility: Packaged Desktop releases continue loading bundled dist/index.html. Community development now intentionally rejects fallback ports and LAN-wide frontend binding. Node 18.17, 20, and 22 are supported; Node 24 is rejected
  because the current Umi dependency chain is incompatible.

Reviewer map

• Start here: script/dev-community.sh, RendererSourceResolver.java, RendererSource.java, force-community-loopback.cjs, and jbr-runtime-manifest.sh.
• Failure condition: The launcher fails fast when ports 8889/10825 are occupied, Java/JBR is incompatible, the JBR checksum fails, or Umi selects a fallback port. A failed development renderer displays a retry page instead of silently loading stale
  packaged assets.
• Rollback or disable path: Revert commit d8985754. Automatic JBR downloads can be disabled with CHAT2DB_JBR_DOWNLOAD=never, with an explicit compatible JBR_HOME supplied instead.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Substantial AI assistance was used for implementation, regression tests, documentation synchronization, and final review. The resulting behavior and diff were manually verified.