feat: #78 Excalidraw finitions + #67 push + #68 health-detailed + #77 desktop jumplist

#78 Excalidraw — finitions B5/C8/F2/F3
- backend/indexer.py: port Python pur de lz-string decompressFromBase64 (bitsPerChar=6, resetValue=32) validé contre 4 fixtures JS truth (texte accentué, edge cases) — remplace le stub base64 non-fonctionnel
- B5 indexation: .excalidraw.md (format plugin Obsidian) maintenant décompressé côté Python → texte indexé pour recherche TF-IDF
- 7 nouveaux tests B5 dans tests/test_excalidraw.py (13/13 total)
- F2: excalidraw-viewer.test.mjs enregistré dans CI (lint job)
- F3: tests/e2e/excalidraw.spec.js (9 specs — ouverture .excalidraw/.excalidraw.md, création via modale/menu contextuel, toolbar, thème, pop-out, recherche)
- Fixtures test_vault/diagram.excalidraw + diagram.excalidraw.md

#67 Push notifications (Web Push API + VAPID)
- backend/push.py: router + VAPID keys + send_push_notification (pywebpush>=2.3.0)
- frontend/js/push.js: subscription UI + service worker integration
- tests/test_push.py: 10 tests (subscribe/list/unsubscribe/vapid key)
- requirements.txt + sw.js + locales push strings

#68 Health check enrichi
- backend/main.py: GET /api/health/detailed (admin) — memory/cpu/disk/backups/index/SSE connections
- backend/indexer.py: _last_full_index_ts tracking
- tests/conftest.py: admin_client fixture
- tests/test_api_main.py: 3 nouveaux tests health detailed

#77 Desktop jumplist
- desktop/src/jumplist.rs: Windows jumplist integration
- Cargo.toml/lock + capabilities + main.rs
- frontend/js/desktop.js: Tauri bridge (isTauriEnv, invoke, getSystemTheme, syncSystemTheme, shouldShowWizard, crash banner)
- tests/frontend/desktop.test.mjs: 21 tests JSDOM (détection, invoke degradation, theme gating, wizard, crash banner)
- tests/frontend/unit.test.mjs: desktop.js whitelisted (standalone global reader)

# Frontend & CI
- frontend/sw.js: réécriture complète (precache + push event handlers + offline)
- frontend/index.html: section push dans settings + about repositionné
- frontend/js/app.js: initDesktopIntegration + initPush
- CI .gitea/workflows/ci.yml: excalidraw-viewer.test.mjs ajouté au lint job

All checks: ruff clean, 552 backend tests pass, 9 frontend unit, 5 excalidraw-viewer, 21 desktop, 9 pane-manager, validate-imports 33 modules.

frontend/js/app.js

@@ -20,6 +20,8 @@ import { initMobileToolbar } from './mobile-toolbar.js';
 import { initDragDrop } from './dragdrop.js';
 import { initMermaid, setupFocusMode } from './mermaid-viewer.js';
 import PaneManager from './pane-manager.js';
+import { initDesktopIntegration, isTauriEnv } from './desktop.js';
+import { initPush } from './push.js';
 
 // =========================================================================
 // Initialization — mirrors the original app.js init() ordering
@@ -30,6 +32,10 @@ async function init() {
   //    LocalStorage has correct language if user set it previously
   await initI18n();
 
+  // 1b. Desktop bridge — crash banner + OS theme sync (before theme engine).
+  //     No-op on web (Docker); on desktop it also readies the vault picker.
+  await initDesktopIntegration();
+
   // 2. Init auth — now t() works inside showApp()/renderUserMenu()
   const authOk = await Auth.AuthManager.initAuth();
 
@@ -62,7 +68,8 @@ async function init() {
   UI.TabManager.init();
   PaneManager.init();
   initCommandPalette();
-  initMobileToolbar();
+    initMobileToolbar();
+    initPush();
 
   if (authOk) {
     Legacy.initSyncStatus();