feat(widget): optional dev-overlay hook + notification plugin

[urbanlama]

Summary

Adds a tiny opt-in hook that lets a private dev companion mount additional UI into the widget's WebView at build time. Default builds are completely unaffected — the JS hook is tree-shaken when VITE_TOKENBBQ_DEV_OVERLAY is unset, and the new Rust deps stay dormant until JS calls them.

The reason this lands here rather than as a fork: the overlay needs a stable Tauri-side anchor (tray with id `"main"`, notification plugin registered, CSP that allows HTTPS `connect-src`). Forking the widget for those four lines would be unmaintainable; a documented opt-in hook is much smaller and the changes are useful even on their own (CSP relaxation is the only one that has any visible effect, and it only matters if the WebView ever fetches HTTPS — currently it doesn't).

Changes

File	What
`widget/src/dev-overlay.ts`	New 14-LOC file. Dynamic-imports `import.meta.env.VITE_TOKENBBQ_DEV_OVERLAY` and calls its `mountOverlay()`. Branch is dead code without the env var → tree-shaken.
`widget/src/main.ts`	One-line `import "./dev-overlay";` near the top.
`widget/.gitignore`	Ignore `public/tokenbbq-dev-overlay.js` (drop target for private builds).
`widget/src-tauri/Cargo.toml`	Add `tauri-plugin-notification = "2"`.
`widget/src-tauri/src/lib.rs`	Register notification plugin; `TrayIconBuilder::with_id("main")` instead of `::new()` so JS can do `TrayIcon.getById("main")`.
`widget/src-tauri/capabilities/default.json`	Add `notification:default`, `core:tray:default`, `core:image:default`.
`widget/src-tauri/tauri.conf.json`	Relax CSP: `connect-src` allows `https:`, `img-src`/`media-src` allow `blob:`/`data:`.

Risk profile

• Zero behavior change without the env var. The only thing a default build does differently is carry a dormant notification plugin (~tens of KB in the binary) and a slightly more permissive CSP that's still strict against script-src.
• `with_id("main")` is a strict superset of `::new()` — same return type, same chain, just a labeled tray.
• No changes to the CLI or any logic users rely on.

Test plan

• `cargo check` passes locally
• `tsc --noEmit` passes locally
• CI green
• `npm run widget:build` produces a working installer with no env var set; tray + autostart still function exactly as before

🤖 Generated with Claude Code

[urbanlama]

Switching to a private fork so the public repo stays untouched.