build: add standalone desktop builder

Dockerfile.builder

@@ -0,0 +1,53 @@
+FROM node:24-bookworm AS build
+WORKDIR /workspace
+
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+    build-essential \
+    clang \
+    curl \
+    file \
+    libayatana-appindicator3-dev \
+    libssl-dev \
+    libwebkit2gtk-4.1-dev \
+    libxdo-dev \
+    lld \
+    llvm \
+    nsis \
+    patchelf \
+    pkg-config \
+    librsvg2-dev \
+    wget \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --profile minimal
+ENV PATH="/root/.cargo/bin:$PATH"
+
+RUN rustup target add x86_64-pc-windows-msvc \
+  && cargo install --locked cargo-xwin
+
+COPY package.json ./
+RUN npm install
+
+COPY . .
+
+# Signed updater artifacts are produced by the release pipeline once its
+# persistent signing key is available. This builder intentionally packages
+# the desktop app itself without creating updater signatures.
+RUN node -e "const fs=require('fs'); const p='src-tauri/tauri.conf.json'; const c=JSON.parse(fs.readFileSync(p,'utf8')); c.bundle.createUpdaterArtifacts=false; fs.writeFileSync(p, JSON.stringify(c,null,2)+'\\n')"
+
+RUN npm run bundle:windows
+RUN npm run bundle:deb
+
+RUN set -eux; \
+    mkdir -p /desktop-artifacts; \
+    win="$(find src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis -maxdepth 1 -type f -name '*-setup.exe' -print -quit)"; \
+    deb="$(find src-tauri/target/release/bundle/deb -maxdepth 1 -type f -name '*.deb' -print -quit)"; \
+    test -n "$win"; \
+    test -n "$deb"; \
+    cp "$win" /desktop-artifacts/fieldlens-print-windows-x64-setup.exe; \
+    cp "$deb" /desktop-artifacts/fieldlens-print-linux-x64.deb; \
+    sha256sum /desktop-artifacts/* > /desktop-artifacts/SHA256SUMS
+
+FROM nginx:1.27-alpine
+COPY --from=build /desktop-artifacts /usr/share/nginx/html
+EXPOSE 80