feat(desktop): add read-only ClickUp prototype

[smikes-autom8]

Summary

• add a preview-gated ClickUp tab for a read-only My Work view
• keep personal tokens in the OS keyring behind Tauri IPC and scope credentials, workspaces, and task reads to the active Buzz identity
• cover urgency grouping, task detail, transient and auth failures, narrow-window focus behavior, bounded pagination, redirects, rate limits, and token redaction

Why

This provides a local prototype for reviewing assigned ClickUp work inside Buzz without introducing task mutations, direct renderer network access, or a second task database. The personal-token connection is intended for local validation only; a distributable version still requires a hosted OAuth exchange or a documented public-client flow.

Implementation notes

• ClickUp requests run in Rust through a no-redirect client; React never receives the stored token.
• Credential replacement is verified and rolled back transactionally, and identity changes during connection are rejected.
• Task, detail, and comment responses are constrained to the selected Workspace and current-user open-task scope.
• The existing persona-event flush loop was moved into its owning module so current file-size ratchets remain satisfied after command registration.
• No real ClickUp token or task data was used during development or validation.

Validation

• just ci
• 3,909 desktop frontend tests passed
• 2,099 Tauri tests plus 3 diagnostics passed; 14 environment-dependent keychain/relay tests were ignored
• desktop and web production builds passed
• mobile analysis and tests passed, with the suite's existing intentional skip

Buzz context

buzz://message?channel=2c26a93f-eee8-4a95-a7c2-fbb8f94b3f34&id=04d99d7d83a39b18618fb833f43ecd90c462502d3b4ac37b36455c76603e2aca