chore(desktop-client): add macOS code-signing and notarization scaffolding

- Move the build config out of package.json into electron-builder.yml so
  the mac block can carry hardenedRuntime, entitlements, universal arch,
  and usage-description Info.plist keys. Drop identity:null (which
  forces unsigned builds) and let CSC_NAME or the keychain decide.
- Add entitlements plist files and three helper scripts: sign-setup.sh
  (one-time keychain prep with notarytool store-credentials),
  sign-mac.sh (sign + notarize + staple, supports keychain or CI env
  vars), and ci-import-cert.sh (CI keychain bootstrap).
- Ignore .env.signing so local credentials don't sneak into the repo,
  and pin @emnapi/{core,runtime} as devDependencies so universal builds
  resolve them deterministically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/package.json

@@ -14,6 +14,8 @@
     "dev": "unset ELECTRON_RUN_AS_NODE && electron-vite dev --inspect=9229",
     "build": "electron-vite build",
     "package:mac": "electron-builder --mac --arm64",
+    "sign:setup": "bash scripts/sign-setup.sh",
+    "sign:mac": "bash scripts/sign-mac.sh",
     "test": "vitest run",
     "typecheck": "vue-tsc --noEmit"
   },
@@ -46,81 +48,5 @@
     "vue": "^3.5.31",
     "vue-router": "^4.5.1",
     "vue-tsc": "^3.2.6"
-  },
-  "build": {
-    "appId": "com.geo.rankly.desktop",
-    "productName": "省心推",
-    "copyright": "Copyright © 2026 shengxintui.com. All Rights Reserved.",
-    "directories": {
-      "output": "release",
-      "buildResources": "build"
-    },
-    "compression": "maximum",
-    "removePackageScripts": true,
-    "removePackageKeywords": true,
-    "asar": true,
-    "asarUnpack": [
-      "**/node_modules/better-sqlite3/build/Release/**",
-      "**/node_modules/better-sqlite3/lib/**",
-      "**/node_modules/bindings/**",
-      "**/node_modules/file-uri-to-path/**",
-      "**/node_modules/playwright-core/lib/**",
-      "**/node_modules/playwright-core/bin/**"
-    ],
-    "files": [
-      "out/**/*",
-      "package.json",
-      "!**/*.map",
-      "!**/*.ts",
-      "!**/*.tsx",
-      "!**/*.md",
-      "!**/*.markdown",
-      "!**/{test,tests,__tests__,__mocks__,example,examples,docs,doc,demo,samples,man}/**",
-      "!**/{LICENSE,LICENSE.*,license,CHANGELOG,CHANGELOG.*,README,README.*,HISTORY,HISTORY.*,AUTHORS,CONTRIBUTING}*",
-      "!**/.*",
-      "!**/node_modules/.bin/**",
-      "!**/node_modules/*/{Makefile,Gulpfile.js,Gruntfile.js,CMakeLists.txt,*.coffee,*.flow,*.c,*.cc,*.cpp,*.h,*.hpp,*.gyp,*.gypi,*.tgz,binding.gyp}",
-      "!**/node_modules/**/{*.d.ts,tsconfig*.json,jest.config*,rollup.config*,webpack.config*,vite.config*}",
-      "!**/node_modules/better-sqlite3/{deps,src,docs,benchmark}/**",
-      "!**/node_modules/better-sqlite3/{test_extension.c,download.sh,*.gyp,*.gypi}",
-      "!**/node_modules/playwright-core/{types,ThirdPartyNotices.txt}/**",
-      "!**/node_modules/**/*.{c,cc,cpp,h,hpp,cmake,m4,am,sh}"
-    ],
-    "mac": {
-      "category": "public.app-category.productivity",
-      "identity": null,
-      "electronLanguages": ["en", "zh_CN"],
-      "target": [
-        { "target": "dmg", "arch": ["arm64"] },
-        { "target": "zip", "arch": ["arm64"] }
-      ],
-      "notarize": false,
-      "hardenedRuntime": false,
-      "gatekeeperAssess": false
-    },
-    "dmg": {
-      "format": "ULFO",
-      "contents": [
-        { "x": 130, "y": 220 },
-        { "x": 410, "y": 220, "type": "link", "path": "/Applications" }
-      ]
-    },
-    "win": {
-      "target": [
-        { "target": "nsis", "arch": ["x64"] }
-      ]
-    },
-    "nsis": {
-      "oneClick": false,
-      "perMachine": false,
-      "allowToChangeInstallationDirectory": true
-    },
-    "linux": {
-      "target": [
-        { "target": "AppImage", "arch": ["x64"] }
-      ],
-      "category": "Office"
-    },
-    "publish": null
   }
 }