feat: wire capture profiles into desktop runtime

[kev1n77]

Summary

• add a versioned, validated CaptureProfile desktop contract for profile name, Gateway upstream origin, and exact additional hosts
• load and persist the active Profile through the encrypted workspace settings store
• apply the same Profile-derived capture policy to both the local Gateway and explicit proxy runtimes
• expose Profile state in workspace bootstrap data and add an atomic paused-Gateway update command with runtime rollback

Scope

This PR establishes the domain model and desktop runtime boundary. The Profile settings UI and frontend command wrapper will follow as a separate reviewable change.

Verification

• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• npm run desktop:check (49 tests passed)
• npm run desktop:build
• Playwright: 3/4 checks passed; the thousand-request performance assertion was locally blocked by 7-14s browser startup time against a 2s budget
• Rust tests could not compile locally because the vendored OpenSSL build requires Perl, which is not installed; GitHub CI will perform the multi-platform Rust verification