feat(install): DMG → Applications install guidance end-to-end

Three changes fix the "user runs app directly from DMG → keychain
broken" funnel at three points:

1. Boot-time check (install-check.ts) — if `process.execPath` starts
   with `/Volumes/`, show a blocking dialog before anything else loads.
   Primary button opens the Applications folder and quits so the user
   can drag-install cleanly. Escape hatch left for power users who
   really want to run from the mount.

2. Custom DMG background + layout (build/dmg-background.{svg,png,@2x.png},
   electron-builder.yml dmg: block) — replaces the default empty DMG
   window with a branded 640×480 backdrop: headline "把 Open CoDesign
   拖到「应用程序」", an arrow pointing right, and a footer warning about
   the keychain consequence of double-clicking from the mount. Icon
   positions pinned so drag-to-install is the obvious path.

3. Smart download on the website (SmartDownload.vue + theme/index.ts
   registration, embedded in index.md and zh/index.md) — detects
   UA + platform, picks the right .dmg / .exe / .AppImage, and renders
   a prominent primary button with exact file name and size. All
   platforms still reachable via a collapsible "Other platforms"
   section. Includes an explicit install hint so users know to drag
   to /Applications before launching.

Plus two UX polishes reported while reviewing the page:
- Hero image swapped from og.svg (social card shape) to logo-hero.png
  (the transparent no-text logo variant) in both EN and zh index.md.
- Hide VitePress's default "#" header-anchor on marketing-home section
  headings — the anchor is useful in docs, noise on landing.

The `apps/desktop/build/` directory is now un-gitignored so the DMG
background ships with the repo instead of being regenerated at every
build.

- apps/desktop/src/main/install-check.ts: boot-time DMG detection
- apps/desktop/src/main/index.ts: wire install-check into whenReady
- apps/desktop/electron-builder.yml: dmg window + icon layout
- apps/desktop/build/dmg-background.{svg,png,@2x.png}: branded backdrop
- website/.vitepress/theme/SmartDownload.vue: new component
- website/.vitepress/theme/index.ts: register SmartDownload globally
- website/.vitepress/theme/style.css: hide header-anchor in sections
- website/index.md + zh/index.md: hero image, SmartDownload embed
- website/public/logo-hero.png: transparent no-text logo for hero

Author: hqhq1025

.gitignore

@@ -6,6 +6,7 @@ node_modules/
 dist/
 dist-electron/
 build/
+!apps/desktop/build/
 out/
 release/
 *.tsbuildinfo

apps/desktop/build/dmg-background.png

@@ -25,6 +25,26 @@ mac:
   target:
     - target: dmg
       arch: [arm64, x64]
+dmg:
+  # Custom window layout guides users to drag the app into /Applications.
+  # Running from the DMG mount leaves safeStorage unavailable (the volume
+  # is read-only so macOS can't establish a keychain trust entry), which
+  # breaks API key save / import. The background, arrow, and in-app boot
+  # check (install-check.ts) work together to steer users to the right
+  # flow.
+  background: build/dmg-background.png
+  iconSize: 92
+  window:
+    width: 640
+    height: 480
+  contents:
+    - x: 140
+      y: 240
+      type: file
+    - x: 500
+      y: 240
+      type: link
+      path: /Applications
 win:
   icon: resources/icon.ico
   target:

apps/desktop/build/dmg-background.svg

@@ -31,6 +31,7 @@ import { makeRuntimeVerifier } from './done-verify';
 import { BrowserWindow, app, dialog, ipcMain, shell } from './electron-runtime';
 import { registerExporterIpc } from './exporter-ipc';
 import { armGenerationTimeout, cancelGenerationRequest } from './generation-ipc';
+import { maybeAbortIfRunningFromDmg } from './install-check';
 import { registerLocaleIpc } from './locale-ipc';
 import { getLogPath, getLogger, initLogger } from './logger';
 import {
@@ -786,6 +787,11 @@ function setupAutoUpdater(): void {
 
 void app.whenReady().then(async () => {
   initLogger();
+  // Show a blocking dialog if the user launched from the DMG mount. If
+  // they accept the remedy, we quit here before touching safeStorage / the
+  // snapshots DB so nothing half-initialises against a bad install.
+  const aborted = await maybeAbortIfRunningFromDmg();
+  if (aborted) return;
   await loadConfigOnBoot();
   // Snapshot persistence is best-effort at boot — a failure here (corrupt DB,
   // permission denied, missing native binding) must NOT block the BrowserWindow

apps/desktop/build/dmg-background@2x.png

@@ -0,0 +1,75 @@
+import { app, dialog, shell } from './electron-runtime';
+import { getLogger } from './logger';
+
+/**
+ * Installation sanity checks that run before anything else at boot.
+ *
+ * The main case we care about: on macOS, users frequently double-click the
+ * app icon inside the mounted DMG instead of dragging it to /Applications
+ * first. That launches the binary from `/Volumes/Open CoDesign/...` — a
+ * read-only mount whose identity Electron can't use to establish a stable
+ * keychain entry, so `safeStorage.isEncryptionAvailable()` returns false
+ * and every "save API key" / "decrypt API key" path fails hard.
+ *
+ * Rather than let the user hit that wall minutes later with a cryptic
+ * error, we detect the condition at startup and offer a one-click fix:
+ * open the Applications folder, quit, and let them drag-install properly.
+ */
+
+const log = getLogger('install-check');
+
+function isRunningFromDmgMount(): boolean {
+  if (process.platform !== 'darwin') return false;
+  // Apps launched from a mounted DMG always have an exec path somewhere
+  // under /Volumes/. Apps dragged to /Applications live under
+  // /Applications/... and never match. Dev builds from pnpm run from
+  // node_modules/electron/dist and also don't match.
+  return process.execPath.startsWith('/Volumes/');
+}
+
+/**
+ * If the app is running from a DMG mount, show an explanatory dialog.
+ * When the user clicks the primary action we open Finder at the
+ * Applications folder and quit the app — they can then drag the app
+ * across and relaunch from the correct location.
+ *
+ * Returns true when the app should stop booting (user chose to quit),
+ * false to continue normally.
+ */
+export async function maybeAbortIfRunningFromDmg(): Promise<boolean> {
+  if (!isRunningFromDmgMount()) return false;
+  log.warn('boot.blocked', { reason: 'running_from_dmg', execPath: process.execPath });
+
+  const { response } = await dialog.showMessageBox({
+    type: 'warning',
+    title: 'Open CoDesign 还没安装完成',
+    message: '请先把 Open CoDesign 拖到「应用程序」文件夹',
+    detail: [
+      '当前是从 DMG 直接运行的。这样 macOS 无法为 Open CoDesign 建立钥匙串条目，',
+      '你的 API key 会无法加密保存，导入配置也会失败。',
+      '',
+      '正确步骤：',
+      '1. 点下面的「打开「应用程序」文件夹」',
+      '2. 把 Finder 里的 Open CoDesign.app 拖进去',
+      '3. 从「应用程序」文件夹双击启动',
+      '',
+      '首次从「应用程序」启动时 macOS 会弹「来自网络的 app」确认框，点「打开」即可。',
+    ].join('\n'),
+    buttons: ['打开「应用程序」文件夹并退出', '仍要从 DMG 运行（不推荐）'],
+    defaultId: 0,
+    cancelId: 1,
+  });
+
+  if (response === 0) {
+    try {
+      await shell.openPath('/Applications');
+    } catch (err) {
+      log.warn('openPath.applications.fail', err);
+    }
+    app.quit();
+    return true;
+  }
+
+  log.warn('boot.continued_from_dmg_despite_warning');
+  return false;
+}