feat: stream Python-sidecar waveform through IPC into renderer canvas

[simonhagger]

Summary

• Sidecar \GET /waveform?points=n: pure-Python multi-harmonic synthesizer + 32-bin DFT magnitude spectrum (no new runtime dependencies — packaged runtime stays deterministic)
• New validated IPC channel \python:waveform\ with zod request/response schemas (envelope + correlation-ID consistent with existing handlers)
• \PythonSidecar.waveform()\ client, preload \waveform()\ API, extended \DesktopPythonApi\
• Sidecar Lab Signal Pipeline pane: polls at 150 ms, draws oscilloscope trace + spectrum bars on canvas, shows round-trip latency; interval cleared on destroy

Validation

• Python sidecar suite: 8/8 passed (2 new endpoint tests)
• contracts/desktop-api/preload/desktop-main builds green; desktop-main TS 84/84; renderer tests + lint green
• End-to-end path exercises sidecar health monitor, validated-handler authz, envelope validation, and canvas rendering

Security Checklist

• Security review completed
• Threat model updated or N/A explained
• Confirmed no secrets/sensitive data present in committed files