…on first launch (#19)

* feat(desktop): bundle ApeMind MCP placeholder + seed default recipes on first launch

Three pieces for the ApeCloud distribution layer:

1. forge.config.ts: add `default-recipes` to extraResource so the
   directory ships inside the packaged app's Resources path.

2. main.ts seedDefaultRecipes(): on app startup, read recipe YAMLs from
   the bundled `default-recipes/` directory (packaged: process.resourcesPath;
   dev: relative to __dirname) and copy them to ~/.config/goose/recipes/.
   Same-name files are skipped (never overwrite user edits). This
   intentionally uses goose's existing user-recipe directory so the
   reader logic in goose-rs and the Desktop UI need no changes —
   upstream-merge-friendly.

3. bundled-extensions.json: add an `apemind` entry of type
   streamable_http, enabled=false, uri="" — appears in the extensions
   list with description prompting the user to configure URL + token
   before enabling. URL/token intentionally not hardcoded.

Recipe YAML content authored separately in #18 (placed at
ui/desktop/default-recipes/).

5-cat compliance: category 3 (默认配置 / bundled extension config) +
category 5 (打包分发 / forge extraResource + first-copy logic). Zero
changes to Rust crates or recipe reader logic.

Signed-off-by: earayu <earayu@163.com>

* fix(desktop): wire Authorization header for bundled streamable_http ApeMind MCP

Per earayu2 #鹅岛 msg 792dda6a:
- ApeMind MCP placeholder URL: `https://your-apemind.example.com/mcp`
- Auth header placeholder: `Authorization: Bearer your-api-key-here`

Two pieces:

1. `bundled-extensions.json` apemind entry: add `uri` + `headers.Authorization`
   placeholder values so the user only has to swap `your-api-key-here` (and
   adjust the URL if needed) when enabling.

2. `bundled-extensions.ts` BundledExtension type + streamable_http loader case:
   extend to propagate `headers` (and `envs`/`env_keys`) into the actual
   extension config. Without this, the JSON `headers` field is silently
   dropped during sync, so the auth would never reach the runtime.

5-cat compliance: still category 3 (默认配置 / bundled extension config). The
loader extension is a 1-line TS plumbing pass-through, not a change to the
goose-rs extension runtime — minimal rebase surface upstream-side.

Signed-off-by: earayu <earayu@163.com>

---------

Signed-off-by: earayu <earayu@163.com>