feat: bind proxy IPC to sidecar process

[kev1n77]

Summary

• expose the launched sidecar PID and bind the first valid Proxy IPC message to that process on Windows and macOS
• run peer verification while the loopback socket is established and inside the existing two-second connection deadline
• keep peer verification, process attribution cache, and sidecar identity in one bounded Proxy session state; retain token-only fallback on unsupported platforms

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets -- -D warnings