Desktop D1 — run the herocast TanStack app under deno desktop (TARGET=deno build) #772

Part of epic #754 (Next→TanStack migration). Desktop work item D1 of 3.
Direction + full plan: docs/migration/desktop-deno-runtime.md.

Goal — "it runs"

Get the real herocast TanStack app running inside a desktop window via the Deno desktop runtime (the desktop app is the TanStack app — no separate consumer shim).

Scope

• Add a TARGET=deno branch to vite.config.mts hostPlugins (Nitro deno-server/deno-deploy preset, mirroring the existing vercel branch).
• Alias cloudflare:workers → the empty stub for all environments on the Deno target (same as the non-CF branch already does).
• Add deno.json with { "desktop": { "backend": "cef" } } (pin the backend — the canary defaulted to cef despite docs; cef is the chosen default for rendering fidelity).
• TARGET=deno vite build → universal fetch server entry; deno desktop wraps it.

Proof / acceptance

• The actual app opens in a desktop window; /feeds renders real casts; sidebar nav + opening a thread work; no fatal console errors. → screenshot + a 5-line manual checklist in the PR.
• pnpm web:typecheck + the existing Cloudflare build stay green (the TARGET=deno branch is additive).

Gating preconditions (don't start until)

• custom channels #13 cutover done (TanStack is the default web app).
• deno desktop has a stable (non-canary) release — OR we consciously accept canary for an internal beta only.

Already proven by the spike (scripts/spikes/deno-desktop/)

• Host seams fall through on Deno with zero new code (serverEnv()→process.env, cache→memory).
• deno desktop builds+launches+renders end-to-end on macOS (hello-world).

Next: D2 (secrets-safe data/auth + key custody).