Sidebar Capabilities + System Settings, and always-on openXYOS preview

[XYAIStudio]

Summary

Ships the two product changes requested for the Windows desktop app (version stays 0.0.1).

Rebased onto origin/main (db20b437 / #18) so this no longer conflicts. Both sides are kept:

• Skip desktop first-run password, database, and admin wizard #18 desktop first-run: skip password / DB / admin wizard; bind local SQLite + guest; first screen is model API only (is_desktop_process, ensure_local_user, _emit_wizard_password early return).
• This PR: sidebar IA + always-on openXYOS sidecar preview + Windows node.exe launch + frameguard fix (_ensure_desktop_org_sidecar).

CHANGELOG.md Unreleased now lists both #18 and #19 bullets. server.py / locales auto-merged with both behaviors. FREEOS_STAMP is generated at portable package time from GITHUB_SHA + UTC timestamp (desktop/portable/package.sh); this rebase head a2ad7f0 will stamp a new portable when Desktop Package CI runs — no committed stamp constant to bump.

A) Sidebar IA

• The old Settings group (nav.settings / 「设置」) is now Capabilities / 「能力」 (nav.capabilities).
• Former Control + Admin items are no longer separate sidebar groups. They live under one top-level System Settings / 「系统设置」 entry, permission-gated (navAllowed / userCan). Guests without those modules never see the item or the admin routes.
• Hub: /system-settings/:section (users, models, storage, plugins, security, advanced, ACP, agent-config). Workbench and remote desktop stay on their existing fullscreen routes but highlight System Settings.
• Old URLs still work via redirects (/admin/*, /acp, /agent-config, /models, …).

B) openXYOS sidecar — always on + in-app preview

Root causes of 「启动边车」无效:

1. Windows spawn — Python Popen of start-sidecar.bat is not a valid Win32 app. Host now starts bundled node.exe --import tsx backend/server.ts (same as Wails), with cmd /c only as fallback.
2. Iframe blank — Helmet default X-Frame-Options: SAMEORIGIN blocked embedding 127.0.0.1:3780 from the dashboard port. Sidecar now disables frameguard when FREEOS_HOME / AIR_GAP_MODE is set.
3. UI — Preview only rendered at the bottom when already up. Organization is now a left/right workspace: FreeOS controls on the left, openXYOS preview on the right, with fullscreen. Start sidecar polls until reachable and then embeds.
4. Always on — Wails boot waits for /api/health/livez after start, and requires dist/index.html. The Python host also ensure_sidecar on OCTOP_DESKTOP=1 / FREEOS_ORG_ENABLE when the portable org-sidecar runtime is present (does not run the source-tree npm start script).

Does not reintroduce an Octop login wall or change WebView2 startup. Release assets are not rebuilt or replaced here.

Target branch

• Base is develop (feature / fix — default)
• Base is main (requested for this coordinator ship)

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation
• Refactor / chore
• Release / hotfix

Test plan

• Backend: uv run ruff check/format, uv run mypy src/octop (534 files), uv run pytest tests/unit — 2839 passed, 4 skipped
• Pre-commit: make precommit + dashboard npm run build green
• Dashboard: vitest for sidebar / system-settings / permissions / stream-error paths; npx tsc --noEmit
• make all as a single Make target (format + lint + typecheck + full pytest) — equivalent pieces above are green; Linux Go desktop tests need gtk4/webkit and were not run here
• Added/updated tests (sidebarNav, SystemSettings/tabs, controlAdminPath, test_sidecar_launch.py, Go sidecarReady frontend-build check)
• CI on this rebase: Python 3.12, Windows Python, Desktop Package windows-amd64 / arm64

Windows verification (after review, before coordinator ships installer)

1. Install / first launch FreeOS desktop (OCTOP_DESKTOP=1, ~/.freeos). Confirm org-sidecar is bundled (node.exe, openxyos/backend/server.ts, openxyos/dist/index.html).
2. Check ~/.freeos/logs/org-sidecar.log and that http://127.0.0.1:3780/api/health/livez is up without clicking anything.
3. Open 组织 OS. Right pane should show the openXYOS console (or a start overlay). 启动边车 should refresh and embed, not only spawn a process.
4. Use 全屏 on the preview, then Escape / 退出全屏.
5. Sidebar: 能力 group (skills / channels / connectors / …); 系统设置 contains former 控制+管理. A user without those permissions must not see admin tabs.
6. Bookmarks /admin/users, /acp, /workbench still work.
7. First launch still skips password / DB / admin and lands on the model API step (Skip desktop first-run password, database, and admin wizard #18).

Do not merge or replace GitHub Release assets from this PR — coordinator ships after review.

Checklist

• Updated CHANGELOG.md (Unreleased) — both Skip desktop first-run password, database, and admin wizard #18 and Sidebar Capabilities + System Settings, and always-on openXYOS preview #19 bullets
• README / docs updated (if needed) — desktop README already described sidecar boot; behavior now matches

Key files

• dashboard/src/layouts/sidebarNav.tsx, dashboard/src/pages/SystemSettings/*, dashboard/src/routes/index.tsx
• dashboard/src/pages/Organization/index.tsx
• src/octop/modules/org_os/sidecar_launch.py, src/octop/infra/server.py
• desktop/src/process_sidecar.go, desktop/src/main.go
• modules/openxyos/backend/server.ts (frame-ancestors / no SAMEORIGIN when embedded)