feat: add automated deployment workspace

[ShahabSL]

Summary

• add an Automatic deployment mode that collects cPanel and hidden-server access, deploys the public host and local or remote hidden server, verifies the result, and returns the final twoman://profile text
• add an Advanced mode for backend, path, service, proxy, TLS, probe, and repository customization
• add in-app monitoring, remote hidden-server status/log/restart controls, rollback controls, and replayable first-use coach markers
• harden installer bootstrapping, credential handling, remote SSH execution, partial-failure rollback, Passenger cleanup, and Windows portable packaging
• document the desktop deployment workflow and add deterministic desktop/mobile UI smoke coverage

Why

The existing deployment flow works but requires users to coordinate cPanel deployment, hidden-server installation, verification, rollback, and profile extraction manually. This change exposes the existing control plane through the desktop application so users provide credentials and access details while Twoman performs and reports the deployment stages.

Compatibility and operational impact

• the existing Client workspace remains the default and its profile/connect behavior is unchanged
• this PR does not change the broker protocol or helper/client dataplane
• Windows deployment runs the established Linux installer through WSL instead of duplicating deployment behavior in Rust
• local and remote hidden-server targets are supported; remote monitoring and control use the saved SSH configuration
• rollback metadata and the management launcher are written before the first remote mutation, allowing cleanup after partial failures
• SSH passwords are passed through SSHPASS rather than process arguments, and persisted deployment state remains root-readable only

Screenshots

Desktop advanced deployment

Mobile deployment workspace

Validation

Validated from an isolated worktree containing only commit d5b95d7:

• python -m unittest discover -s tests: 63 passed
• cd helper-agent && go test ./...: passed
• cd client-cli && go test ./...: passed
• bash tests/run_e2e_go_node_http.sh: passed
• bash tests/run_client_cli_e2e.sh: passed
• npm ci && npm audit && npm run build: production build passed, 0 vulnerabilities
• npm run smoke:deploy: passed across 1440x1000 and 390x844 viewports; verifies Client remains the initial workspace, coach persistence/replay, Automatic/Advanced modes, remote SSH fields, profile output, monitoring, and rollback
• cargo fmt --check && cargo test: 9 passed; 2 live credential-dependent tests ignored
• targeted bash -n and ShellCheck for installer/rollback scripts: passed
• MinGW Windows portable executable and bundled sidecars: built and launch-smoked with the Twoman window visible

Deployment and rollback considerations

The application requires WSL for automated deployment on Windows. It detects unavailable WSL, sudo requirements, and missing Linux dependencies before starting. Rollback can independently remove public-host files and hidden services or retain state for investigation.

Not tested

• no real cPanel/shared-host account or hidden-server SSH endpoint was available, so the final live infrastructure acceptance test remains outstanding
• MSI/NSIS installers were not generated because the local Visual Studio installation lacks the Windows SDK; the portable Windows package was built and launch-tested
• the two existing live Tauri runtime tests remain ignored because they require real broker credentials and Windows tunnel support