MANUAL RUN: pair a real phone with the codeSplitters desktop over Tailscale #457

From #448. Pairing was tested with curl (faking a tunnel's Host header) and in Chrome on the Mac, not with a real tunnel. To check:

1. Start the desktop with RB_LISTEN=127.0.0.1:4800 bun run desktop in apps/codesplitters.
2. Run tailscale serve --bg http://127.0.0.1:4800, with Tailscale on the Mac and the phone.
3. On the desktop, sign in, click 📱, enter https://<mac>.<tailnet>.ts.net, make a link, and open it on the phone.
4. Check that the phone signs in by alias, can edit a file, and that the Agent button runs. Then open the same link again and confirm it gets 403.
5. Run tailscale serve --https=443 off afterwards.