security: minimize desktop renderer capabilities - #209

Review: approved ✅ — small diff, disproportionate security value

+65/−31 that removes real attack surface now that #192/#207 made the renderer a thin client.

Verified in the diff

• fs:default capability and the entire tauri-plugin-fs dependency removed (package.json, Cargo.toml, Cargo.lock, lib.rs). Not just de-permissioned — the plugin is gone, so there is no capability to re-enable by accident. That's the strongest form of this fix.
• dialog:default → dialog:allow-open, opener:default → opener:allow-default-urls, process:default → process:allow-restart. Each narrowed to the one operation actually used. process:default included generic process exit; opener:default is broader than default-URL opening.
• https://api.deepseek.com removed from connect-src in the CSP. This is the one I'd highlight: with the provider gone from the renderer (feat: move desktop runtime behind app server #192, refactor: remove legacy desktop runtime facades #207), the WebView has no legitimate reason to reach the provider API — and leaving it in connect-src would have preserved an exfiltration route for anything that did achieve script execution in the WebView. Removing it makes the thin-client boundary enforced by the browser engine itself, not just by which code we ship.
• Gate item 6 in release-gates-v1.md locks all of this against regression.

On the security-model.md edits: both corrections make the doc less flattering and more accurate — threat #4's mitigation now reads as exact-definition review rather than the old sandbox claim, and the plugin section now says gated-capability-API rather than "no host fs/net access". Replacing an overstated guarantee with an accurate one is the right instinct; an overstated boundary is more dangerous than an acknowledged gap, because people build on it.

Validation: CI green; full suite green locally at the stack tip.