fix: handle deep links that launch the app

[doowta]

Links that launch a closed Maple app can arrive before its webview listener and be lost. This reads the deep-link plugin's buffered URL after subscribing, then remembers handled payment links across reloads so the app settles on the requested page. First step of #1023.

Rebased onto current master (432ed1ef). The shared startup handler preserves the newer native OAuth pending-attempt and verified-account confirmation checks, and keeps Dev/production callback schemes separate. Auth URLs and credential-bearing malformed links never enter the replay cache. When replay storage is unavailable, settled payment routes avoid another reload; fresh live links remain actionable.

Validation at 22bebb71

• Frontend format, lint and typecheck passed; 1,298 tests passed, including 25 focused deep-link tests.
• Rust full rerun passed: 423 library tests + 3 CLI tests, with 2 existing ignored tests. The first run hit a one-second timeout in an unchanged Agent timing test; that exact test and the full suite both passed on rerun without a competing build.
• Built and verified the unsigned host-architecture Research Dev macOS package with nix develop --no-update-lock-file .#ci -c ./scripts/ci/research-dev-desktop.sh.
• Exact installed package tested on macOS 27.0.1 (Apple Silicon), bundle/scheme cloud.opensecret.maple.dev, API https://enclave.secretgpt.ai, auth origin https://auth-dev.maple.ai. Executable SHA-256: 4ec9e60b632d14d163856ec359c63e60b51736a77bd9838ae82a3d2c6f53ddc2.
• Native runtime: identical cancellation URL across two full quits; same URL again while running after navigating away; cold credits return; live subscription-success return; unsolicited cold auth and malformed auth rejection.
• Real GitHub OAuth: provider callback → hosted confirmation → OS return → native account confirmation; cancel leaves the app signed out; retry/approval signs in to the same existing Dev account.

Payment-return tests used synthetic links and made no purchases. The Free account's credits return reached its gated API settings page. iOS, Android, Windows and Linux runtime, Google/Apple sign-in, Team-plan runtime and real payment checkout were not tested. A process restart intentionally loses an in-memory native OAuth attempt and requires restarting sign-in.

[AnthonyRonning]

Thanks for the detailed write-up. Sign-in links go through this same handler, so before we review this further, please test OAuth sign-in end to end with this change:

• Sign in with each provider (Google, GitHub, Apple) from a signed-out Maple Dev app, once with the app left open and once with it fully quit (on iOS, force-closed) before the browser hands back to the app.
• Check that opening an already-used sign-in link again doesn't sign anyone in, and that no sign-in grant ends up in storage.
• Cover at least macOS and iOS, since mobile is where the app gets closed mid-flow.

Please add recordings or screenshots of each case to this PR.