fix: QA hardening across desktop connect, CLI, setup, and PWA update flow (#52)

- desktop: probe-then-persist server URL — scheme-less input tries https
  then http; a failed probe no longer saves a dead URL that would trap
  the next launch in a redirect to a broken address
- frontend: close the create-collection modal on successful submit
  (backdrop stayed mounted and intercepted navigation)
- frontend: reload once on service-worker controllerchange so returning
  users don't run a stale cached shell after a deploy
- frontend: gate dashboard empty states on resource loading to stop the
  "No project selected" / "Create your workspace" flash
- cli: resolve scheduled-job refs by name or id for jobs:run, jobs:runs,
  and jobs:rm, matching bucket/org resolution
- cli: correct stale pk_live_/pk_test_ help text to the real prm_ format;
  align README command spellings and demo seed prefixes
- setup: rewrite all public URL vars (auth, vite, backend) and cookie
  domain for the entered host — https for domains, http for IPs — with
  anchored full-line substitutions so stale ports/paths can't survive
- docs: VITE_* vars never reach the frontend image build; the app
  resolves API/auth URLs same-origin at runtime, so host changes need no
  rebuild — noted HTTPS requirement for PWA/secure-context features

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/desktop/ui/index.html

@@ -101,6 +101,18 @@
         tauri?.event.emit("open-vault");
       });
 
+      const probe = async (url) => {
+        try {
+          // Opaque (no-cors) — proves the host answers, not that it is a
+          // Primora deployment. A wrong-but-alive URL is recoverable via the
+          // tray menu's "Change server".
+          await fetch(url, { mode: "no-cors", signal: AbortSignal.timeout(8000) });
+          return true;
+        } catch {
+          return false;
+        }
+      };
+
       form.addEventListener("submit", async (event) => {
         event.preventDefault();
         err.hidden = true;
@@ -108,7 +120,17 @@
         button.textContent = "Checking…";
 
         let url = input.value.trim();
-        if (!/^https?:\/\//i.test(url)) url = `https://${url}`;
+        if (!/^https?:\/\//i.test(url)) {
+          // Self-hosted deployments are often plain HTTP on a LAN — probe
+          // https first, fall back to http, and only keep the one that answers.
+          const https = `https://${url}`;
+          url = (await probe(https)) ? https : `http://${url}`;
+        }
+
+        if (!(await probe(url))) {
+          fail("Server did not respond. Check the URL and that the deployment is up.");
+          return;
+        }
 
         try {
           await tauri.core.invoke("set_server_url", { url });
@@ -117,16 +139,6 @@
           return;
         }
 
-        // Reachability probe — opaque (no-cors), so it proves the host answers,
-        // not that it is a Primora deployment. A wrong-but-alive URL is recoverable
-        // via the tray menu's "Change server".
-        try {
-          await fetch(url, { mode: "no-cors", signal: AbortSignal.timeout(8000) });
-        } catch {
-          fail("Server did not respond. Check the URL and that the deployment is up.");
-          return;
-        }
-
         location.replace(url);
       });
     </script>