fix(electron): decrypt keys after ready and harden navigation and IPC

- Apply preset env after app ready, so Windows/Linux get decrypted keys
- Never re-encrypt ciphertext; restore env when switching or removing presets
- Block navigation away from the app, open external links in the browser, check IPC senders
- Keep inherited proxy settings, default NO_PROXY for localhost
- Serialize server start/restart, kill stuck processes, follow port changes
- Atomic config writes, keep corrupt files as backups, remember the server port
- Menu and settings window stay in sync; dev script gets the decrypted preset env
- Use app.isPackaged, parse inline .env comments, drop .env files from the bundle

scripts/prepare-electron-build.mjs

@@ -73,6 +73,15 @@ mkdirSync(targetDir, { recursive: true })
 console.log("Copying standalone directory...")
 copyDereferenced(standaloneDir, targetDir)
 
+// Next.js copies the build machine's .env files into standalone; don't ship
+// them, they can hold the builder's API keys
+for (const entry of readdirSync(targetDir)) {
+    if (entry.startsWith(".env")) {
+        console.warn(`Removing ${entry} so it is not packaged into the app`)
+        rmSync(join(targetDir, entry))
+    }
+}
+
 // Copy static files
 console.log("Copying static files...")
 const targetStaticDir = join(targetDir, ".next", "static")