fix: harden client transport and split app startup

[lyyzka]

Summary

• preserve authentication and tenant headers when callers provide RequestInit headers
• route native JSON API requests explicitly through CapacitorHttp while keeping presigned File uploads on WebView fetch
• keep the Electron OAuth nonce armed after invalid callbacks and consume it only after a valid match
• split notification, native, admin, desktop, mobile, and analytics startup surfaces into lazy chunks

Validation

• npm test (298 passed)
• npm run build
• npm run lint
• npm run typecheck
• npm run server:typecheck
• npm run guard:agent-os
• npm run guard:brand
• npm run guard:llm-tracked
• npm run version:check
• npx cap sync
• npm run test:integration (skipped: INTEGRATION_DATABASE_URL is not configured locally)

Closes #73
Closes #74
Closes #76
Closes #77

[lyyzka]

Addressed the review blockers in 26d5b70:

• R2 CORS is now part of the production deployment path. The deployment validates complete R2 configuration, runs a dedicated r2-cors Compose tool before cutover, includes the production web origin plus Electron/iOS/Android origins, and fails unless the applied bucket policy passes readback validation.
• Native startup no longer awaits bootNative before importing/rendering App. Native event listeners are registered without blocking the shell, and StatusBar bridge work runs asynchronously.
• Added an opt-in physical-device upload acceptance panel and protocol for a real 24 MiB file (the largest representative payload below the 25 MiB product limit), including profiler evidence requirements.

Local evidence: 301 unit tests passed; normal and smoke-enabled builds passed; lint, frontend/server typecheck, guards, version check, and Capacitor sync passed.

Remaining external evidence is explicitly not fabricated: this host has no Xcode/iOS Simulator, Android SDK/ADB, Docker Compose, R2 credentials, or connected physical device. Therefore actual target-bucket readback and iOS/Android profiler captures must be produced by the credentialed deployment/device environment using docs/mobile-upload-device-smoke.md.