feat: #78 Excalidraw finitions + #67 push + #68 health-detailed + #77 desktop jumplist

#78 Excalidraw — finitions B5/C8/F2/F3
- backend/indexer.py: port Python pur de lz-string decompressFromBase64 (bitsPerChar=6, resetValue=32) validé contre 4 fixtures JS truth (texte accentué, edge cases) — remplace le stub base64 non-fonctionnel
- B5 indexation: .excalidraw.md (format plugin Obsidian) maintenant décompressé côté Python → texte indexé pour recherche TF-IDF
- 7 nouveaux tests B5 dans tests/test_excalidraw.py (13/13 total)
- F2: excalidraw-viewer.test.mjs enregistré dans CI (lint job)
- F3: tests/e2e/excalidraw.spec.js (9 specs — ouverture .excalidraw/.excalidraw.md, création via modale/menu contextuel, toolbar, thème, pop-out, recherche)
- Fixtures test_vault/diagram.excalidraw + diagram.excalidraw.md

#67 Push notifications (Web Push API + VAPID)
- backend/push.py: router + VAPID keys + send_push_notification (pywebpush>=2.3.0)
- frontend/js/push.js: subscription UI + service worker integration
- tests/test_push.py: 10 tests (subscribe/list/unsubscribe/vapid key)
- requirements.txt + sw.js + locales push strings

#68 Health check enrichi
- backend/main.py: GET /api/health/detailed (admin) — memory/cpu/disk/backups/index/SSE connections
- backend/indexer.py: _last_full_index_ts tracking
- tests/conftest.py: admin_client fixture
- tests/test_api_main.py: 3 nouveaux tests health detailed

#77 Desktop jumplist
- desktop/src/jumplist.rs: Windows jumplist integration
- Cargo.toml/lock + capabilities + main.rs
- frontend/js/desktop.js: Tauri bridge (isTauriEnv, invoke, getSystemTheme, syncSystemTheme, shouldShowWizard, crash banner)
- tests/frontend/desktop.test.mjs: 21 tests JSDOM (détection, invoke degradation, theme gating, wizard, crash banner)
- tests/frontend/unit.test.mjs: desktop.js whitelisted (standalone global reader)

# Frontend & CI
- frontend/sw.js: réécriture complète (precache + push event handlers + offline)
- frontend/index.html: section push dans settings + about repositionné
- frontend/js/app.js: initDesktopIntegration + initPush
- CI .gitea/workflows/ci.yml: excalidraw-viewer.test.mjs ajouté au lint job

All checks: ruff clean, 552 backend tests pass, 9 frontend unit, 5 excalidraw-viewer, 21 desktop, 9 pane-manager, validate-imports 33 modules.

desktop/src/main.rs

@@ -5,6 +5,8 @@
 
 #![windows_subsystem = "windows"]
 
+mod jumplist;
+
 use log::{error, info, warn};
 use serde::{Deserialize, Serialize};
 use std::fs::{self, OpenOptions};
@@ -579,6 +581,10 @@ fn main() {
             // Build native menu bar (File / Edit / Help)
             let _ = build_native_menu(app);
 
+            // Windows taskbar jump list — recent vaults (best-effort).
+            let jumplist_vaults = jumplist::build_vault_args(&config.vaults);
+            jumplist::update_jumplist(&jumplist_vaults);
+
             // Restore window position/size
             if let Some(window) = app.get_webview_window("main") {
                 if let (Some(x), Some(y)) = (config.window_x, config.window_y) {
@@ -872,8 +878,14 @@ fn build_tray_menu(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
 mod tests {
     use super::*;
     use std::fs;
+    use std::sync::Mutex;
     use tempfile::TempDir;
 
+    /// Serializes the `pick_free_port` tests: they bind real TCP ports, so
+    /// running them in parallel makes them clobber each other's port.
+    static PORT_TEST_LOCK: Mutex<()> = Mutex::new(());
+
+
     /// Helper: write config to a temp dir and read it back
     fn roundtrip_config(config: &AppConfig) -> AppConfig {
         let tmp = TempDir::new().unwrap();
@@ -973,6 +985,7 @@ mod tests {
 
     #[test]
     fn test_pick_free_port_is_free() {
+        let _guard = PORT_TEST_LOCK.lock().unwrap();
         let port = pick_free_port();
         assert!((DEFAULT_BACKEND_PORT..DEFAULT_BACKEND_PORT + PORT_SCAN_ATTEMPTS).contains(&port));
         assert!(TcpListener::bind(("127.0.0.1", port)).is_ok());
@@ -980,6 +993,7 @@ mod tests {
 
     #[test]
     fn test_pick_free_port_skips_busy_port() {
+        let _guard = PORT_TEST_LOCK.lock().unwrap();
         let blocker = match TcpListener::bind(("127.0.0.1", DEFAULT_BACKEND_PORT)) {
             Ok(l) => l,
             Err(_) => return, // default port already busy on this machine — skip