feat(desktop-client): fall back to authenticated desktop asset endpoint

When a public asset URL fails (e.g. stale signed token), retry via the
new /api/desktop/content/assets endpoint with the desktop Bearer token
so editor images keep rendering across token rotations.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/transport/api-client.ts

@@ -147,6 +147,24 @@ export function resolveDesktopApiURL(path: string): string {
   return resolveDesktopURL(path);
 }
 
+export async function fetchDesktopApiURL(input: string | URL, init: RequestInit = {}): Promise<Response> {
+  const headers = new Headers(init.headers);
+  if (transportSession.clientToken && !headers.has("Authorization")) {
+    headers.set("Authorization", `Bearer ${transportSession.clientToken}`);
+  }
+
+  const url =
+    input instanceof URL
+      ? input.toString()
+      : /^https?:\/\//i.test(input)
+        ? input
+        : resolveDesktopURL(input);
+  return fetch(url, {
+    ...init,
+    headers,
+  });
+}
+
 function resolveObservedRequestURL(path: string | undefined, baseURL: string): string {
   if (!path) {
     return baseURL;