FEA-1469: Add Symphony web POC surface

[aeyeCEO]

Summary

• Adds a Labs-gated Symphony Web POC surface as a sibling iframe view alongside the existing dashboard-focused Electron UI.
• Adds a main-process SymphonyWebPocRuntime with local SQLite seed data, a desktop-local API, a local fallback harness, external URL mode, and spawned Next mode via CL_SYMPHONY_APP_DIR.
• Exposes runtime status/restart through IPC/preload and passes desktop_api_url, desktop_api_token, and desktop-local hints into the embedded web surface.
• Keeps this POC stacked on PRD-407 and does not merge the existing dashboard IA into the Symphony web path.

Hardening Included

• Token-gates the local POC API and scopes CORS to the active web origin.
• Handles spawned web process errors without crashing Electron.
• Reserves a web port before spawning Next to avoid silently iframeing an unrelated local service.
• Stops spawned web process groups with SIGTERM/SIGKILL escalation.
• Serializes stop/start races and returns effective env-overridden feature flags to the renderer.

Validation

• pnpm --dir apps/desktop exec tsx --test test/symphony-web-poc-runtime.test.ts test/feature-flags.test.ts test/agent-monitor-wiring-static.test.ts
• pnpm --dir apps/desktop exec tsc -p tsconfig.json --noEmit
• pnpm --dir apps/desktop lint
• pnpm --dir apps/desktop test
• pnpm --dir apps/desktop build

Notes

The Electron-side POC can host a local harness, an external Symphony URL, or spawn a local Next app. Running the exact Symphony web app against the SQLite API still requires the companion symphony-alpha desktop-local auth/provider/API seam so the web app consumes desktop_api_url and desktop_api_token.

[github-actions]

Compatibility Smoke Test Results ⚠️

Status: skipped
Electron SHA: c4e88568696857c23b7d5662e044ed75efb4d886
Symphony Alpha SHA (last-known-good): 24741ed9be45cc761195d7a7b6613bd30cdfce84
Note: Skipped because the stage GitHub App credentials are not configured for this workflow run.

View Actions run

[aeyeCEO]

Follow-up after Andrew's UI expectation feedback:

• The POC no longer leaves the default path at the diagnostic SQLite/runtime harness when a local symphony-alpha checkout is available.
• Electron now auto-discovers a sibling symphony-alpha/apps/app, starts the real Symphony Next app via pnpm exec next <mode> -p <port>, and opens /closedloop-ai/my-tasks by default.
• The local API/runtime harness remains as a fallback and backend seed layer, not the expected primary user-facing POC surface.
• I also bumped apps/desktop to 0.15.103 because this stacked PR changes desktop files relative to PRD-407-in-process-only.

Local verification:

• pnpm --dir apps/desktop test
• pnpm --dir apps/desktop exec tsc -p tsconfig.json --noEmit
• pnpm --dir apps/desktop lint
• pnpm --dir apps/desktop build
• focused Symphony POC tests after the version bump

Remaining blocker for the exact screenshot-level experience: direct local boot of the real symphony-alpha app now reaches the app render path, but it still needs the web-app-side local auth/env seam. After installing deps and building @closedloop-ai/loops-api, /closedloop-ai/my-tasks fails on missing Clerk publishable key/auth context. That is the next companion change needed for the web UI to render fully against the desktop-local SQLite-backed API.

[aeyeCEO]

Closing this PR for now. This prototype should not be in review until it proves something useful locally: specifically, the real Symphony web app UI rendering inside Electron against the desktop-local backend/auth path rather than just a launcher/fallback harness. The branch can stay as local working material, but the PR should come back only once that local proof is real.