Surface the desktop server switcher and allow a different server per window

[bhushit]

What was wrong

bb desktop already lets you point the app at a remote bb server (Window ▸ Server, Window ▸ Set Server URL…), but it has three gaps:

1. Undiscoverable — the only entry point is a native menu most users never open.
2. One custom URL at a time — the custom target holds a single URL; setting a new one replaces it.
3. App-global + hijacking — the target is global, so all windows are forced onto the same server, and switching a window to a remote replaces its content. If that remote needs sign-in, you can get stranded on its gate page with no in-app way back.

Refs #1451 (multiple desktop servers / remote handoff) and #483 (the original remote-session request the switcher shipped from).

What changed

All behind a new remoteUi experiment (default off):

• Surface the switcher in-app — a sidebar-footer indicator + popover, and a Connection settings page, so switching/adding servers no longer requires the native menu.
• User-curated server list — replace the single custom URL with an add/remove allowlist (server-target.ts, v2 schema + migration); auto-discovered getbb Connect machines list alongside.
• A different server per window — selecting a remote opens it in its own window (openRemoteServerWindow), leaving This Mac in place; closing the window returns you. Per-window Connect session; auth failure falls through to load the server so its gate can prompt sign-in instead of a fatal error — you can never be stranded.
• Security parity with the native menu — every server-target mutation (switch and edit) is gated to the builtin/This-Mac origin (isBuiltinServerOrigin), and the switcher only renders on the This Mac window. A remote or compromised page can neither drive nor display it.
• Custom getbb origins authenticate through Connect (fixes the existing custom-path sign-in dead-end).

New BbDesktopApi members are experimental_-prefixed with docs/api_to_audit.md entries. No HOST_DAEMON_PROTOCOL_VERSION change (no server↔daemon wire touched).

How you verified

• pnpm exec turbo run typecheck test lint green across @bb/app, @bb/desktop, @bb/desktop-contract, @bb/domain (0 errors).
• Unit tests added: builtin-only origin guard (getbb/remote origins rejected for switching), v1→v2 migration, switcher hidden when not on This Mac, Connection add/remove + disabled-on-remote.
• Manual (dev desktop): opened a remote in its own window, closed it to return, confirmed a remote page can't render or drive the switcher, and This Mac switching works.

Refs #1451

AGENT GENERATED