fix: refactored electron-main.js

[hanneshapke]

Summary

Refactor of src/frontend/src/electron/electron-main.js (the Electron main
process) in two passes. No behavior change — same IPC channels, same response
shapes, same lifecycle.

Before: 1 file, 1958 lines.
After: electron-main.js 1216 lines + ipc-handlers.js 509 lines.

What changed

Pass 1 — in-file deduplication

• Extracted defineConfigField(key, getChannel, setChannel, opts) — replaces
  14 inline ipcMain.handle blocks that all followed the same
  read-config / mutate / write-config pattern (boolean flags, model directory,
  transparent proxy, entity confidence).
• Extracted backendRequest(method, path, body?) — replaces 4 hand-rolled
  net.request Promise blocks (reload-model, get-model-info, transparent-proxy
  notify, entity-confidence notify).
• Added notifyBackendBestEffort(path, body) for the "save succeeded so don't
  surface backend errors" pattern.
• Extracted applyTrayIcon / resolveTrayIconInfo — the tray icon resolution
  (template-vs-color, darwin resize, tooltip) was duplicated between
  createTray() and the autoUpdater update-downloaded handler.
• Dropped 6 inline require("electron").shell.openExternal(...) calls —
  shell was already imported at the top.
• Simplified getResourcesPath() — the if (darwin) branch and the fallback
  returned the exact same expression.

Pass 2 — module split

• New file ipc-handlers.js exports registerIpcHandlers({ ... }).
• All 29 ipcMain.handle channels moved over, along with their helpers
  (backendRequest, notifyBackendBestEffort, defineConfigField,
  VALID_PROVIDERS — none of these are used outside IPC code).
• Dependencies are injected (readConfig, saveConfig, encryptApiKey,
  decryptApiKey, restartGoBinary, waitForBackend, getMainWindow) so the
  new module never imports from electron-main.js. getMainWindow is passed
  as an accessor (() => mainWindow) since mainWindow is reassigned across
  the app lifecycle.
• electron-main.js no longer needs ipcMain in its electron require.

Behavior note

One subtle shift worth flagging: the simple-field IPC handlers (e.g.
set-welcome-dismissed) now go through readConfig() / saveConfig() instead
of doing raw fs.readFileSync on config.json. That means setting one of
these flags also runs the legacy → multi-provider config migration if the user
is on a pre-migration config. The migration is idempotent and was already
triggered by every API-key handler, so this only changes when it runs for
users who never touched provider settings — not the resulting state.

Test plan

• npm run electron:dev boots, splash → main window appears, backend
  reaches /health.
• Open Settings, enter / save an API key for each provider, restart the
  backend, confirm provider config persists.
• Toggle "transparent proxy" and "entity confidence"; confirm the backend
  receives the updates (or that we still report success if it doesn't).
• Trigger "Reload Model" and "Get Model Info" from the UI.
• Reveal CA cert (both when ca.crt exists and when it doesn't yet).
• Tray menu items (Open / About / Settings / Terms / Docs / Bug / Feature /
  Email / Quit) all work.
• Dismiss welcome / accept terms / complete tour — restart and confirm
  flags persist.
• Force an update-downloaded event (or wait for one) and verify the tray
  icon swaps to the update variant.