sec(desktop): narrow capabilities — drop shell:default, process:default, http://*

Replace over-broad default grants with the minimum set the UI actually
needs:

- shell:default → shell:allow-open (only shellOpen(url) is called from
  the frontend — no shell:execute).
- process:default → process:allow-restart (relaunch is the only usage;
  exit-arbitrary is not).
- http:default now scopes to https://* and the loopback http origins
  (localhost / 127.0.0.1). Plain-HTTP arbitrary hosts are refused;
  users who need an insecure remote provider must opt in explicitly
  rather than getting it by default.
- opener:allow-open-path entries with "app": true are removed; the
  app alias is now validated server-side (validate_open_app_name)
  and the `open_path` Tauri command already gates the filesystem
  target (validate_open_target), so the extra "app": true surface
  is redundant and only widened the XSS blast radius.

Closes #8/21.

Author: Rwanbt

packages/desktop/src-tauri/capabilities/default.json

@@ -12,11 +12,7 @@
         { "path": "**/*" },
         { "path": "/**/*" },
         { "path": "**/.*/*/**" },
-        { "path": "/**/.*/*/**" },
-        { "path": "**/*", "app": true },
-        { "path": "/**/*", "app": true },
-        { "path": "**/.*/*/**", "app": true },
-        { "path": "/**/.*/*/**", "app": true }
+        { "path": "/**/.*/*/**" }
       ]
     },
     "deep-link:default",
@@ -35,17 +31,24 @@
     "core:window:allow-is-maximized",
     "core:window:allow-toggle-maximize",
     "decorum:allow-show-snap-overlay",
-    "shell:default",
+    "shell:allow-open",
     "updater:default",
     "dialog:default",
-    "process:default",
+    "process:allow-restart",
     "store:default",
     "window-state:default",
     "os:default",
     "notification:default",
     {
       "identifier": "http:default",
-      "allow": [{ "url": "http://*" }, { "url": "https://*" }, { "url": "http://*:*/*" }, { "url": "https://*:*/*" }]
+      "allow": [
+        { "url": "https://*" },
+        { "url": "https://*:*/*" },
+        { "url": "http://127.0.0.1" },
+        { "url": "http://127.0.0.1:*/*" },
+        { "url": "http://localhost" },
+        { "url": "http://localhost:*/*" }
+      ]
     },
     "clipboard-manager:allow-read-image"
   ]