feat(p1.10): desktop diagnostics export

[attson]

Summary

Implements P1.10 from the roadmap: a new Settings → Diagnostics tab that produces a redaction-safe plaintext snapshot of desktop runtime state — for users to paste into bug reports.

• New tab SettingsDiagnostics.vue shows a live preview, with [ Copy ], [ Export ], and [ Refresh ] buttons.
• Two new Wails bindings on App:
  • `GetDiagnostics(userAgent string) DiagnosticsPayload` — collects app version, OS + arch + version (via per-OS system_version_*.go helpers calling sw_vers / /etc/os-release / cmd ver), WebView identifier parsed from navigator.userAgent, redacted relay URL (scheme+host only), relay status, redacted relay token, allow-insecure flag, remote permission, uplink-paused flag, recent relay errors, and a config summary (default shell, locale, theme, notifications, shell integration, WebGL, logging path, auto-update, command notify threshold).
  • `ExportDiagnostics(content string) (path, error)` — opens native Save dialog, writes .txt. writeFile is injected so tests can stub disk.
• Recent relay errors ring buffer (size 5) on `App`, fed by a new `recordError func(error)` callback wired into desktop/uplink.go's retry path and handleCloseError (auth-related codes 4001–4003).
• Redaction helpers with focused tests: redactToken (first 12 chars + …), redactURL (drops path/query/fragment), redactErrorLine (atk_ tokens + Authorization + Cookie headers).
• JSON contract test pins DiagnosticsPayload field names so renames break loudly.
• i18n keys `settings.diagnostics.{tab,hint,copy,export,refresh,copied,copyFailed,exported}` in en + zh-CN.

Spec: `docs/superpowers/specs/2026-06-01-desktop-diagnostics-export-design.md`
Plan: `docs/superpowers/plans/2026-06-01-desktop-diagnostics-export.md`

Test Plan

• `go test ./...` — green (4 redaction sub-cases, 4 ring-buffer tests, 3 collectDiagnostics tests, 1 uplink integration test for close-error recording, 2 export writer tests)
• `go vet ./...` — clean
• `npm test` — 75 files / 626 tests green (7 formatDiagnostics, 5 SettingsDiagnostics component, plus SettingsDialog tab-list adjustments)
• `npx vue-tsc --noEmit` — clean
• `npm run build:wails` — clean
• `npm run build:capacitor` — clean
• manual: open desktop app → Settings → Diagnostics. Preview populates; Copy writes formatted text to clipboard; Export opens Save dialog with default name atterm-diagnostics-<ts>.txt. Force a 401 token → Refresh → error appears in "Recent relay errors".

Redaction guarantees (in spec §4, covered by tests)

• API tokens shown as first 12 chars + … only
• Relay URL stripped of path/query/fragment (defends against ?token=…)
• Authorization headers → [redacted]
• Cookie headers → [redacted]
• Terminal PTY output is never accessible from `App` — naturally absent