Improve desktop startup recovery and moved-server navigation

[ymichael]

Human comments

What was wrong

Desktop startup error screens left users without direct ways to retry a failed connection or select another server. Connect authentication failures also lacked an account sign-in recovery action, and choosing the built-in server after a move did not explain the retained or deleted local copy.

What changed

• Added contextual startup actions for retrying, choosing a server, reconnecting bb Connect, and opening a moved server. Actions are accepted only from the current error page in an application window's main frame.
• Added account-session recovery for Connect targets. API requests use the selected server's origin; account sign-in uses the account website.
• Selecting the built-in server after a committed move shows where it moved and whether the old copy is locked or deleted, with actions to open the moved server or choose another server. The desktop leaves the move lock and background machine service in place.
• Ownership checks use the selected server handle, including when its hostname differs, and session renewal checks the currently selected target.
• Added platform-appropriate built-in server labels and updated the desktop README and machine guide.

Existing CLI unlock behavior is preserved. No server/daemon wire fields or CI configuration changed.

How you verified

• Local working-tree check: pnpm exec turbo run typecheck test --filter=@bb/desktop --filter=@bb/cli --filter=@bb/server-archive passed: 441 desktop tests, 858 CLI tests, and 82 server-archive tests; one desktop test skipped.
• The macOS Electron smoke test passed for custom-server retry, Connect retry, and fatal errors after correcting its expected headings. These scenarios do not exercise the new interactive account sign-in flow.
• URL assertions cover both Connect API requests, account cookies, HTTP origins, custom ports, and ownership checks using the selected server handle.
• Captured before/after desktop UI comparisons against the branch merge base using disposable profiles and synthetic failures. The real reconnect button opened the public account sign-in page; sign-in completion and live session renewal were not exercised. Linux label previews were rendered on macOS.
• git diff --cached --check passed before committing the scope reduction.

After discarding the uncommitted sign-in isolation change, pnpm exec turbo run typecheck test --filter=@bb/desktop passed on the clean branch (441 tests passed, one skipped), including the macOS Electron smoke scenarios.

AGENT GENERATED