fix(electron): decrypt keys after ready and harden navigation and IPC

- Apply preset env after app ready, so Windows/Linux get decrypted keys
- Never re-encrypt ciphertext; restore env when switching or removing presets
- Block navigation away from the app, open external links in the browser, check IPC senders
- Keep inherited proxy settings, default NO_PROXY for localhost
- Serialize server start/restart, kill stuck processes, follow port changes
- Atomic config writes, keep corrupt files as backups, remember the server port
- Menu and settings window stay in sync; dev script gets the decrypted preset env
- Use app.isPackaged, parse inline .env comments, drop .env files from the bundle

electron/main/window-manager.ts

@@ -3,6 +3,9 @@ import { app, BrowserWindow, screen } from "electron"
 
 let mainWindow: BrowserWindow | null = null
 
+// URL of the app server the main window loads
+let appUrl: string | null = null
+
 /**
  * Get the icon path based on platform
  * Note: electron-builder converts icon.png during packaging,
@@ -28,6 +31,7 @@ function getIconPath(): string | undefined {
  * Create the main application window
  */
 export function createWindow(serverUrl: string): BrowserWindow {
+    appUrl = serverUrl
     const { width, height } = screen.getPrimaryDisplay().workAreaSize
 
     mainWindow = new BrowserWindow({
@@ -56,7 +60,7 @@ export function createWindow(serverUrl: string): BrowserWindow {
     })
 
     // Open DevTools in development
-    if (process.env.NODE_ENV === "development") {
+    if (!app.isPackaged) {
         mainWindow.webContents.openDevTools()
     }
 
@@ -93,3 +97,36 @@ export function createWindow(serverUrl: string): BrowserWindow {
 export function getMainWindow(): BrowserWindow | null {
     return mainWindow
 }
+
+/**
+ * Get the app server URL the main window loads
+ */
+export function getAppUrl(): string | null {
+    return appUrl
+}
+
+/**
+ * Point the main window at a new app server URL
+ * (the restarted server can come up on a different port)
+ */
+export function setAppUrl(url: string): void {
+    if (url === appUrl) {
+        return
+    }
+    appUrl = url
+    mainWindow?.loadURL(url)
+}
+
+/**
+ * Check if a URL belongs to the app server (same origin)
+ */
+export function isAppUrl(url: string | undefined): boolean {
+    if (!url || !appUrl) {
+        return false
+    }
+    try {
+        return new URL(url).origin === new URL(appUrl).origin
+    } catch {
+        return false
+    }
+}