fix: harden desktop dependency graph

[finalflash159]

Summary

• remove the unused shadcn CLI from desktop runtime dependencies
• vendor the exact static Tailwind variant stylesheet with its MIT license
• declare the supported Node.js floor and update Vitest past the current mocker advisory
• add regression coverage for the dependency boundary

Verification

• npm ci (Node 22.22.0)
• npm test --prefix desktop -- --run (263 passed)
• npm run build --prefix desktop
• npm audit --prefix desktop --audit-level=high --registry=https://registry.npmjs.org (0 vulnerabilities)
• uv run pytest -q tests/test_desktop_dependency_manifest.py tests/test_desktop_macos_microphone_plist.py (5 passed)
• uv run ruff check tests/test_desktop_dependency_manifest.py

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing