feat(spaces): add desktop browsing and joining for open spaces

[hrsvrn]

Summary

Harbor supports open spaces after #1121, but the desktop app still assumes that a space must be joined before it can be opened. This PR lets team members browse open spaces, read their content without joining, and explicitly join when they want to participate.

For example, opening a message or file link in an unjoined open space now shows the requested content with a Join space prompt. Joining enables member controls and adds the space to the sidebar without losing the selected content.

User-facing changes

• Add Browse spaces navigation with search, loading, empty, error, and retry states. Private spaces and DMs stay out of the directory.
• Support open-space previews through browsing, deep links, navigation history, and restored navigation.
• Show preview status and Join space actions. Deduplicate pending joins and retain preview mode when a join fails.
• Add an Open/Private choice when creating a space, with Private as the default.
• Keep messages, threads, discussions, files, history, search, and whiteboards readable in previews. Replace composers with join prompts and disable member-only mutations.
• Explain when an older Harbor server does not support browsing; only a missing endpoint is treated as unsupported, rather than authentication or network failures.

Access and live-state handling

Preview access is distinct from membership throughout the renderer. Mutation guards cover retained callbacks and delayed sends as well as visible controls, so losing membership cannot leave an active write action behind.

Preview traffic does not create personal read marks, follows, or outgoing presence. Whiteboards use view mode and suppress outgoing scene, cursor, scene-request, and save operations while continuing to receive updates. Active previews subscribe to live content and recover after reconnect; joined spaces retain their existing background behavior.

Membership changes refresh the roster and directory. Removal immediately disables member actions and clears pending personal read state, then revalidates access and resubscribes if the space remains readable. Revision checks prevent stale responses from replacing newer membership state.

Transport and documentation

• Add typed browse/join client methods and IPC routes through both Electron and server-backed app transports.
• Pass optional visibility through space creation using the existing Harbor protocol.
• Update the Spaces design language for browsing, previews, and explicit joining.
• Add 20 manual test cases, including two-account setup, steps, expected outcomes, and evidence requirements.

Validation

Completed during implementation:

• Harbor workspace build and X shared/core builds passed.
• Renderer, core, server, and Electron TypeScript checks passed.
• Shared tests: 20 files, 321 tests passed.
• Standalone open-spaces client tests: 3 passed.
• Full renderer suite: 133 files, 1,092 tests passed with NODE_OPTIONS=--no-experimental-webstorage npm test -- --run --maxWorkers=4.
• git diff --check passed again before committing.

The renderer command disables Node 26's native WebStorage so the suite uses its jsdom storage implementation. An unrelated PDF preview test failed in an earlier parallel run, then passed in isolation and in the final full run; no PDF code was changed.

The real Harbor client integration tests and server integration suite were blocked in the earlier sandbox by socket/network-interface permission errors (listen EPERM and uv_interface_addresses EPERM). They are not claimed as passing. Live two-account, packaged-app, and visual smoke tests have not been executed; the manual cases are prepared for that review.

Manual review priorities

• Browse as a team member who has not joined: open spaces appear; private spaces and DMs do not.
• Read messages, files, and whiteboards while verifying that preview emits no member-only writes or presence.
• Join from a thread or file, including double clicks and failure/retry, without losing navigation.
• Remove membership from another session and verify immediate transition to read-only or unavailable access.
• Exercise deep links, reconnect, both app transports, and existing joined-space/DM workflows.

Rollout and scope

This is the desktop UI follow-up to #1121 and consumes its additive server APIs. Deploy Harbor support before using the new app features; no coordinated deployment or database migration is introduced here. Existing member workflows and private creation remain supported on older servers.

No new Harbor product rule or wire contract is introduced. Team invites, profiles, admin controls, archive/delete, and mobile UI remain separate work.