fix(desktop): trust the per-worktree Vite dev port for WebKitGTK mic capture - #7407

Summary

Fixes #7406 — huddles on Linux dev builds still fail with NotAllowedError
immediately after the mic is grabbed, because the WebKitGTK
permission-request handler added in #3607 (the fix for #3495) hardcodes the
trusted dev origin as http://localhost:1420, Vite's default port.

Every just-based entrypoint (just dev, just desktop-standalone,
just staging, just production) sources scripts/instance-env.sh, which
derives a stable per-worktree dev port in the range 10000–64999
(10000 + sha256(worktree) % 55000) and points devUrl at
http://localhost:<port>. The webview therefore loads from an origin the
handler never matches, so getUserMedia is denied with NotAllowedError and
the huddle tears down. The 1420 check is dead in practice; #3607 was
apparently validated against the raw default-port path (or a non-Linux
platform), so the regression slipped through the close of #3495.

Change

desktop/src-tauri/src/linux_media.rs only:

• Replace the hardcoded DEV_ORIGIN constant with dev_origin_for_port(),
  which builds http://localhost:<port> from a validated 1–5 digit nonzero
  port, falling back to http://localhost:1420 on missing/empty/non-numeric/
  zero/out-of-range input (so a raw pnpm tauri dev without instance-env
  behaves exactly as before).
• dev_media_origin() reads VITE_PORT from the process env — the exact
  variable instance-env.sh exports before launching tauri dev, inherited
  by the app.
• is_trusted_media_origin(uri, dev_origin: Option<&str>) stays pure and
  unit-testable; the production origin is always trusted, the dev origin only
  when Some (debug builds only).
• The WebKitGTK signal closure moves an owned clone of the trusted origin
  ('static requirement).

Security posture unchanged: scheme + host stay hardcoded to
http://localhost (only the port is env-derived, so no remote host can be
injected), exact-origin / path-prefix matching preserved (port look-alikes
like :14200 still rejected), deny-by-default preserved, and the whole dev
path is #[cfg(debug_assertions)]-gated so packaged builds keep trusting only
tauri://localhost.

Test plan

• cargo test --lib linux_media — 6/6 pass (production origin, dev origin
  + look-alike rejection, port-validation fallback cases)
• cargo clippy --lib — clean for linux_media.rs
• cargo fmt applied (pre-commit desktop-tauri-fmt hook passed)
• Manual: just desktop-standalone on Linux — huddle starts, mic is
  captured, and the companion window stays open (verified by reporter)

Regression tests

dev_origin_for_port is new, pure, and fully unit-tested (configured port,
default fallback, and rejection of "", "not-a-port", "0", "-1",
"99999", "142000"). is_trusted_media_origin keeps its existing
look-alike tests, extended to the parameterized form.