feat(server): sous-commande idea --serve avec serveur HTTP sécurisé pairing+cookie (#13)

Lot B3 du chantier server/client mode : socle serveur sécurisé exposant le
cœur backend en mode client/serveur, sans PTY (reporté B5).

- crates/app-tauri/src/server.rs : sous-commande --serve, serveur HTTP
  sécurisé — /api/invoke sur allowlist, /api/pair → cookie de session,
  Origin strict, refus du secret en query, gate de bind. 16 tests dont les
  2 refus de sécurité (pairing_rejects_wrong_code,
  invoke_rejects_invalid_session_cookie).
- crates/app-tauri/src/lib.rs : câblage de la sous-commande --serve.
- crates/app-tauri/src/commands.rs : adaptations.
- crates/app-tauri/Cargo.toml : deps bytes/cookie/http/http-body-util,
  feature tokio net. Cargo.lock synchronisé.

Validé : cargo check --workspace vert, app-tauri 267 tests verts, cœur
backend agnostique confirmé, desktop non régressé.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/app-tauri/src/commands.rs

@@ -113,6 +113,17 @@ pub async fn create_project(
 pub async fn open_project(
     project_id: String,
     state: State<'_, AppState>,
+) -> Result<ProjectDto, ErrorDto> {
+    open_project_for_adapter(project_id, &state).await
+}
+
+/// Shared `open_project` adapter body used by desktop IPC and the HTTP server.
+///
+/// Keeps the non-presentation side effects attached to project opening in one
+/// place while B3 adds a second driving adapter.
+pub(crate) async fn open_project_for_adapter(
+    project_id: String,
+    state: &AppState,
 ) -> Result<ProjectDto, ErrorDto> {
     let id = parse_project_id(&project_id)?;
     let output = state