desktop: dev launcher loads stranger process when port 5173 is occupied

[Myestery]

Summary

apps/desktop/scripts/electron-dev.mjs hardcodes Vite dev port to 5173 with strictPort: true and treats any TCP listener on 5173 as "Vite is ready". When another process holds the port, Electron's loadURL either renders the stranger's content or Vite crashes on spawn.

Reproduction

1. Hold port 5173 with a non-Vite process — either of:
   • python3 -m http.server 5173 (HTTP — clearest visual)
   • node -e \"require('net').createServer(()=>{}).listen(5173,'0.0.0.0')\" (raw TCP)
2. Run pnpm dev (or pnpm --filter @openwork/desktop dev).

Observed

• Electron window opens and loads whatever the stranger serves (e.g. python directory listing page) instead of the openwork app.
• With raw TCP blocker: launcher hangs ~12s on looksLikeVite fetches (4s × 3 candidate URLs), then Vite child fails to bind 5173 due to strictPort: true, dev session exits.

Root causes

1. electron-dev.mjs line ~205 (pre-fix): portIsOpenForVite fallback flips viteReady = true when anything listens on the port — not just real Vite.
2. No port-availability check before spawning Vite child; strictPort: true in apps/app/vite.config.ts:99 blocks Vite from picking the next port itself.
3. OPENWORK_ELECTRON_START_URL always built from the hardcoded default port, no rebuild after collision.
4. (Side issue) fetchWithTimeout 4s default × multiple candidate URLs causes long hangs against non-HTTP TCP listeners.

Expected

Either:

• Detect port is busy, auto-bump to the next free port, log it, spawn Vite there, build startUrl from the chosen port; or
• If user explicitly set PORT=, fail fast with a clear error rather than silently bumping.

Environment

• macOS (Darwin 25.4.0)
• Reproduces on upstream/dev at the time of writing.