feat(electron): native notification bridge over contextBridge/IPC

Phase 1 step 3 of VNCprodbuild. electron/preload.ts's contextBridge now
exposes window.vnc.showNotification(title, options), routed via
ipcRenderer.invoke("vnc:show-notification") to a new ipcMain.handle in
electron/main.ts that calls Electron's own Notification API. This is the
desktop shell's native notification path - it sits alongside, not in place
of, the browser/PWA's service-worker push path (public/sw.js's push/
notificationclick handlers + lib/web-push.ts), which is untouched.

lib/electron-bridge.ts gives the renderer a `isElectronShell()` +
`showElectronNotification()` wrapper so app code can detect the shell and
use the native path instead of/alongside SW push - not wired to any real
mail-delivery trigger yet, that's Phase 1 steps 4-6 (JMAP realtime
capability investigation, the background/foreground strategy decision, and
implementing it).

Extended e2e/electron-smoke.spec.ts to prove the IPC plumbing actually
fires end-to-end: calls window.vnc.showNotification from the renderer and
asserts the round-trip resolves (not that a real OS toast appears - not
observable in CI). Verified locally: the call resolves {"shown":true} on
this machine, confirming it genuinely reaches Electron's Notification API
and back, not just that window.vnc exists.

Also fixes a real bug caught by this step's typecheck: the smoke test's
Playwright Page variable was named `window`, shadowing the DOM global
inside every evaluate() callback and silently breaking their types. Renamed
to `appWindow`.

All 4 smoke-test assertions green: npm run build:electron && npm run
test:electron.

electron/preload.ts

@@ -2,12 +2,26 @@
 // context with access to Node APIs, and exposes a minimal, explicit surface
 // to the renderer via contextBridge - the renderer never gets direct Node or
 // Electron access (contextIsolation + nodeIntegration: false, see main.ts).
-//
-// Walking-skeleton stub for now: just `isElectron`, so renderer code can
-// detect it's running inside the desktop shell. A real API surface (native
-// notifications, etc.) gets added on top of this bridge in a later step.
-import { contextBridge } from "electron";
+import { contextBridge, ipcRenderer } from "electron";
+
+export interface ShowNotificationOptions {
+  body?: string;
+  tag?: string;
+}
+
+export interface ShowNotificationResult {
+  shown: boolean;
+}
 
 contextBridge.exposeInMainWorld("vnc", {
   isElectron: true,
+  // Routes to Electron's own Notification API in main.ts (ipcMain.handle
+  // "vnc:show-notification"). This is the desktop shell's native
+  // notification path - it does not replace lib/web-push.ts's Web Push
+  // (VAPID) path, which is what the browser/PWA deployment still uses.
+  showNotification: (
+    title: string,
+    options?: ShowNotificationOptions,
+  ): Promise<ShowNotificationResult> =>
+    ipcRenderer.invoke("vnc:show-notification", title, options),
 });