feat(security): address review-critical findings + lock-screen polish

- Critical (5): per-launch DOWNLOAD_SIGNING_SECRET, JWT alg/typ + exp
  type-guard in verifyLocalJwt, sandbox:true on the renderer, raw-stream
  log gated behind MIKE_DEBUG_RAW_STREAM, drop dead workflow column
  insert.
- Session 1 (security): CSP on packaged builds, DevTools gated to
  unpackaged + non-lock-screen, dotenv only loaded in standalone dev,
  pickWorkspace realpath + install-dir guard.
- Session 2 (backend): belt-and-braces user_id on documents DELETE +
  project_id on folder cleanup, global Express error handler,
  127.0.0.1 in signed URLs, 60s timeout + 200MB cap on LibreOffice
  conversion.
- Session 3 (frontend): drop dead incrementMessageCredits, cache JWT
  module-scope in supabase shim, suppress double-loading spinners after
  unlock.
- Lock screen: scope display:flex so .status[hidden] actually hides
  the "Starting Mike..." spinner.

DECISIONS.md updated for the lockout-state choice.
TODO.md updated with the deferred Important + Minor items.
.gitignore now excludes /vendor/ and backend/.dist-bundle/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>