feat(desktop-client): obfuscate JS bundles before packaging

Adds a post-build obfuscation step using javascript-obfuscator with
hidden vite sourcemaps chained back to TypeScript via @ampproject/remapping,
so production packages ship mangled code while debug-time maps still
resolve to original sources. Wires obfuscation into all package:* scripts
via a new build:obf step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/package.json

@@ -13,9 +13,11 @@
   "scripts": {
     "dev": "electron-vite dev --inspect=9229",
     "build": "electron-vite build",
-    "package:mac": "pnpm run build && electron-builder --mac --arm64,universal",
-    "package:win": "pnpm run build && electron-builder --win --x64",
-    "package:linux": "pnpm run build && electron-builder --linux --x64,arm64",
+    "obfuscate": "node scripts/obfuscate.cjs",
+    "build:obf": "pnpm run build && pnpm run obfuscate",
+    "package:mac": "pnpm run build:obf && electron-builder --mac --arm64 --universal",
+    "package:win": "pnpm run build:obf && electron-builder --win --x64",
+    "package:linux": "pnpm run build:obf && electron-builder --linux --x64 --arm64",
     "sign:setup": "bash scripts/sign-setup.sh",
     "sign:mac": "bash scripts/sign-mac.sh",
     "test": "vitest run",
@@ -30,6 +32,7 @@
     "ws": "^8.20.0"
   },
   "devDependencies": {
+    "@ampproject/remapping": "^2.3.0",
     "@ant-design/icons-vue": "^7.0.1",
     "@geo/http-client": "workspace:*",
     "@geo/publisher-platforms": "workspace:*",
@@ -43,6 +46,7 @@
     "electron": "41.2.0",
     "electron-builder": "^25.0.0",
     "electron-vite": "^5.0.0",
+    "javascript-obfuscator": "^5.4.2",
     "typescript": "^5.9.3",
     "unplugin-vue-components": "^32.0.0",
     "vite": "^7.3.2",