fix(desktop): support canonical preview auth

[RossHartmann]

Summary

• embed an optional canonical relay URL in Kiingo desktop builds
• sign NIP-42 for that canonical tenant only when the dialed URL exactly matches the build-configured preview endpoint
• keep arbitrary user-selected communities bound to their own relay URL

Validation

• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml -- --check`n- compilation reached the final Windows link step; the local host's older MSVC runtime cannot link the current prebuilt sherpa/ONNX library, so the repository's current Windows CI runner is the authoritative compile/test gate
• git diff --check`n
  This closes the restricted-preview desktop auth gap without weakening NIP-42 host binding for other relays.