P1: sidecar lifecycle and HTTP bridge

Backend
- sidecar.rs supervises the bundled `mycelium` binary launched via
  pkexec; locates it in resource_dir or CARGO_MANIFEST_DIR/binaries
  matching $TAURI_ENV_TARGET_TRIPLE
- ephemeral port via portpicker, key + config persisted in
  app_data_dir, kill_on_drop with explicit start_kill on stop
- health-check loop calls /api/v1/admin until 2xx (timeout 20s);
  emits sidecar://ready and sidecar://exited
- 500-line ring buffer of stdout/stderr surfaced via sidecar_logs
  command for the upcoming Settings page
- elevation::is_auth_failure(126|127) maps pkexec cancel to a
  dedicated AppError variant
- AppError uses thiserror, Serialize impl renders messages as
  plain strings for the JS side

Frontend
- typed `api` wrapper around invoke() in src/lib/api.ts
- node store (Pinia) bootstraps on mount, listens on
  sidecar://ready and sidecar://exited
- StartupOverlay covers the whole window for idle/starting/error
  phases; sidebar status dot + start/stop button
- Status view renders subnet, pubkey, api endpoint and key path
  with one-click clipboard copy

src/lib/events.ts

@@ -0,0 +1,23 @@
+import { listen, type UnlistenFn, type EventCallback } from "@tauri-apps/api/event";
+
+/**
+ * Backend event names emitted from src-tauri/src/sidecar.rs.
+ * Keep this list in sync with `app.emit(...)` calls there.
+ */
+export const Events = {
+  SidecarReady: "sidecar://ready",
+  SidecarExited: "sidecar://exited",
+  PeersUpdated: "peers://updated",
+  StatsUpdated: "stats://updated",
+  RoutesUpdated: "routes://updated",
+  MessageIncoming: "messages://incoming",
+} as const;
+
+export type EventName = (typeof Events)[keyof typeof Events];
+
+export async function on<T>(
+  event: EventName,
+  handler: EventCallback<T>,
+): Promise<UnlistenFn> {
+  return listen<T>(event, handler);
+}