feat: tray, window-state, sqlite cache, decrypt worker

System tray (desktop)
- tauri tray-icon feature + tray with menu (Öffnen/Ausblenden/Beenden)
- Left-click toggles main window; right-click shows menu
- JS emits tray-unread-update event, Rust mirrors into tooltip +
  macOS dock badge via set_badge_label
- ConversationsContext wires totalUnread → tray

Window state persistence
- tauri-plugin-window-state (desktop-only target guard)
- Auto-restore size/position/maximized between restarts

Local SQLite message cache
- tauri-plugin-sql hydration of conversation view on mount
- persistMessages after each refresh, deleteCachedMessage on realtime
  DELETE, pruneCache keeps latest 1000 per conversation
- Stores plaintext only (same trust boundary as stronghold device
  key; cache never leaves the device, E2EE w.r.t. server unchanged)

Web Worker for decryption
- workers/decrypt.worker.ts runs crypto_secretbox_open_easy + utf-8
  decode off the main thread with its own libsodium instance
- lib/decryptWorker.ts is a request/response wrapper with inline
  fallback when Worker spawn fails
- shared decryptMessages accepts aeadBatchDelegate so key lookup
  stays on the main thread while the AEAD loop offloads

Build fix
- Enable tauri tray-icon feature
- Import Listener + Manager traits, clone tray handle for the
  event listener, conditional icon attach

apps/desktop/src/lib/trayBadge.ts

@@ -0,0 +1,15 @@
+import { emit } from '@tauri-apps/api/event';
+
+import { isTauriRuntime } from './globalShortcut';
+
+// Pushes the current aggregate unread count to the Rust-side tray listener.
+// Rust mirrors it into the tray tooltip + macOS dock badge. No-op in the
+// browser/dev preview where the Tauri runtime isn't present.
+export async function updateTrayUnread(count: number): Promise<void> {
+  if (!isTauriRuntime()) return;
+  try {
+    await emit('tray-unread-update', { count: Math.max(0, Math.floor(count)) });
+  } catch (err: unknown) {
+    console.warn('updateTrayUnread failed', err);
+  }
+}