Fix Electron development startup and macOS tray icon

[P-A-N-52]

Summary

• allow the Vite React Fast Refresh preamble only in Electron development mode
• keep the production script CSP strict
• add an authenticated realtime /ws backend for note database changes
• allow only loopback WebSocket origins and proxy development authentication without exposing the API token in URLs
• prevent React StrictMode and changing callback identities from creating reconnect loops
• add transparent macOS tray template assets for standard and Retina displays
• preserve the existing platform-specific tray icons on Windows and Linux

Root cause

Electron development applied both the checked-in meta CSP and a response CSP that rejected Vite's injected inline React refresh preamble, leaving the app on its splash screen. When the notes page mounted, both policies also rejected its WebSocket connection; after allowing the loopback connection, the request still failed because the backend had no /ws handler. The hook then reconnected repeatedly because stale socket callbacks could overwrite the current connection state.

The macOS tray reused the full application icon as a Template Image; because that icon has an opaque background, macOS rendered the entire mask as a black square.

Impact

npm run electron:dev now renders the React app normally, while packaged production keeps its strict script policy. The notes page maintains one authenticated realtime connection without CSP failures or reconnect spam. Development authentication is injected by the Vite proxy, so the local API token does not appear in the WebSocket URL. The macOS menu-bar icon now uses a transparent monochrome template that adapts to light and dark appearances, including Retina displays.

Validation

• npm test --prefix backend -- --runInBand --detectOpenHandles tests/integration/realtime-websocket.test.ts - 3 tests passed with no open handles
• npm run test:electron:macos - 11 tests passed
• npm run typecheck --prefix backend
• npm run typecheck --prefix frontend
• npm run build:frontend
• verified frontend/dist/index.html keeps script-src 'self'
• real Electron cold launch and notes-page navigation: console remained clean; WebSocket returned 101 Switching Protocols and remained pending
• verified the development WebSocket URL contains no API token
• node --check electron/main.js
• node --check frontend/vite.config.js
• git diff --check

[Alpaca233114514]

good