refactor: complete sprint p0 modularization and auth session hydration

[simonhagger]

Summary

• What changed:
  • Completed P0 sprint refactors for desktop-main IPC modularization, reusable validated IPC handler registration, and preload bridge modularization.
  • Added renderer-level auth session state hydration service and wired Auth Session Lab + JWT guard path to shared state.
  • Updated CURRENT-SPRINT.md progress log to mark BL-016, BL-017, and BL-018 complete with verification notes.
• Why this change is needed:
  • Reduce privileged boundary risk and improve maintainability/testability by separating concerns in desktop-main and preload.
  • Fix UX/state correctness issue where Auth Session Lab could present stale initial login/logout actions before session state was loaded.
• Risk level (low/medium/high):
  • Medium

Change Groups

• Docs / Governance:
  • Updated CURRENT-SPRINT.md with completion + verification evidence for P0 workstreams.
• Frontend / UX:
  • Added startup auth-session hydration service and aligned Auth Session Lab button/state behavior to initialized session data.
• Desktop Main / Preload / Contracts:
  • Refactored desktop-main IPC registration into per-domain handlers with shared validated wrapper.
  • Refactored preload invoke path into shared client and split API namespaces into domain files.
• CI / Tooling:
  • No CI workflow changes in this PR.

Validation

• pnpm nx run contracts:test
• pnpm nx run desktop-main:test
• pnpm nx run renderer:build
• pnpm nx run desktop-main:build
• Additional checks run:
  • pnpm unit-test
  • pnpm integration-test
  • pnpm runtime:smoke
  • pnpm nx run renderer:test

Engineering Checklist

• Conventional Commit title used
• Unit/integration tests added or updated
• A11y impact reviewed
• I18n impact reviewed
• IPC contract changes documented
• ADR added/updated for architecture-level decisions

Security (Required For Sensitive Changes)

IMPORTANT:

• If this PR touches apps/desktop-main/**, apps/desktop-preload/**, libs/shared/contracts/**, .github/workflows/**, or docs/02-architecture/security-architecture.md, the two items below MUST be checked to pass CI.

• Security review completed

• Threat model updated or N/A explained

Security Notes

• Threat model link/update:
  • Existing threat model/workflow coverage remains in place; this PR does not alter trust boundaries or introduce new privileged channels.
• N/A rationale (when no threat model update is needed):
  • Refactor-only changes preserve existing channel contracts/authorization model while consolidating implementation paths.