feat(desktop-client): obfuscate JS bundles before packaging

Adds a post-build obfuscation step using javascript-obfuscator with
hidden vite sourcemaps chained back to TypeScript via @ampproject/remapping,
so production packages ship mangled code while debug-time maps still
resolve to original sources. Wires obfuscation into all package:* scripts
via a new build:obf step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/electron.vite.config.ts

@@ -28,6 +28,7 @@ export default defineConfig({
   main: {
     plugins: [externalizeDepsPlugin({ exclude: workspacePackages })],
     build: {
+      sourcemap: 'hidden',
       rollupOptions: {
         input: {
           bootstrap: resolve(rootDir, 'src/main/bootstrap.ts'),
@@ -49,6 +50,7 @@ export default defineConfig({
   preload: {
     plugins: [externalizeDepsPlugin({ exclude: workspacePackages })],
     build: {
+      sourcemap: 'hidden',
       rollupOptions: {
         input: {
           bridge: resolve(rootDir, 'src/preload/bridge.ts'),
@@ -79,6 +81,9 @@ export default defineConfig({
         ],
       }),
     ],
+    build: {
+      sourcemap: 'hidden',
+    },
     resolve: {
       alias: {
         '@renderer': resolve(rootDir, 'src/renderer'),