ci: run frontend lint/typecheck/build and cargo test on PRs

[johncarmack1984]

Expands the desktop workflow from the single tauri-version preflight into a full PR/main test gate, so a regression is caught on the PR instead of first surfacing in the release build (which only runs on a tag — exactly how the 0.8.0 version-mismatch slipped through).

Adds two jobs alongside the existing tauri-versions check:

• frontend — bun run build (also generates the gitignored routeTree.gen.ts), then tsc --noEmit, then eslint.
• rust — installs the Tauri Linux system libs, builds the frontend (generate_context! embeds ../dist at compile time), then cargo test --workspace --locked: the unit tests plus tests/bindings.rs, the drift guard that fails when src/bindings.ts is stale. --locked also asserts Cargo.lock is committed in sync. #[ignore]'d live-AWS tests are skipped, so no credentials are needed.

Also adds a typecheck script to apps/desktop/package.json so the same check has a local command, and adds a concurrency group so newer pushes supersede in-flight runs.

Verified locally on the current tree: cargo test --workspace --locked → 38 passed / 0 failed / 3 ignored, drift guard ok; tsc --noEmit and eslint clean; actionlint approves the workflow. This PR edits both desktop.yml and apps/desktop/package.json, so all three jobs run on it.