feat(desktop): unify Runtime Host connection-code onboarding

[M4n5ter]

Summary

• Make Add computer the single entry for one-time connection codes, guided SSH setup, Windows-only WSL setup, and manual configuration; keep shared-session joining separate.
• Add help and clipboard actions to the connection-code flow, and let SSH-managed Hosts create a fresh code from their management view.
• Centralize Owner connection-code issuance in the Runtime Host client and expose the same one-time, 15-minute credential flow through maka runtime-host access connection-code.
• Bind every emitted code to the authenticated Host Root and live Direct peer identity, and give each CLI/SSH code an independent principal.

中文说明

• “添加电脑”统一收纳连接码、SSH、仅 Windows 显示的 WSL 与手动配置；加入共享任务仍是独立行为。
• 连接码页面增加获取方式说明和粘贴操作；通过 SSH 管理的 Host 可在管理页新建连接码。
• Desktop 本机、SSH 管理与 CLI 复用同一套一次性 Owner 连接码签发逻辑。
• 每个连接码绑定已认证的 Host Root 与实时 Direct peer 身份；CLI/SSH 每次签发使用独立 principal，互不撤销。

Verification

• npm run format:check
• npm run lint
• npm run build:test
• npm run typecheck
• npm run check:renderer-architecture -- --base origin/main
• npm run check:asf-headers
• npm run astryx:surface-inventory && npm run astryx:surface-inventory:test
• npm run astryx:theme -- --check
• npx knip --workspace apps/desktop
• node scripts/protocol-epoch-check.mjs --base origin/main
• 85 focused Runtime Host, CLI, Desktop management, SSH transport, and local remote-access tests
• macOS Desktop UI inspection: Add computer contains no WSL action; connection-code help and Paste are visible

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex implemented, tested, inspected, and independently reviewed the Runtime Host and Desktop changes.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck, and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[jackwener]

Approved at the explicit direction of M4n5ter. No technical review was performed as part of this action; M4n5ter requested the approval and accepts responsibility for subsequent handling.

---

Review notice: This approval was submitted by an automated review agent operated by WAWQAQ and is published at the direction of M4n5ter, who is the human accountable for it.