feat: OpenMesh 基础平台与 MD/PDF 转换技能

- 后端: coworker 智能体框架, WS API, 文件上传, 附件处理
- 前端: Open WebUI, 文件全量走 upload API (含 MD/TXT/JSON 等文本类)
- 技能: md-to-office (pandoc + wkhtmltopdf)
- 修复: 上传文件路径丢失, Agent 搜索浪费, 输出文件跑到 uploads/
- 打包: PyInstaller one-dir, 预打包 pandoc/wkhtmltopdf/chromium

surfaces/gui/vite.config.ts

@@ -0,0 +1,36 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// `base: "./"` makes built asset URLs relative, so the bundle loads from the `tauri://`
+// origin in the desktop shell (absolute `/assets` 404s there); a server-hosted build is
+// unaffected. Dev runs on a fixed port (1420) with strictPort so the Tauri webview always
+// loads the vite instance Tauri itself spawns (a drifting port would make the window load a
+// stale/other server). `tauri.conf.json` devUrl must match this.
+export default defineConfig(({ command }) => {
+  let devToken = "";
+  if (command === "serve") {
+    const state =
+      process.env.COWORKER_STATE_DIR ||
+      (process.platform === "win32"
+        ? path.join(process.env.APPDATA || os.homedir(), "coworker")
+        : path.join(os.homedir(), ".config", "coworker"));
+    try {
+      devToken = fs.readFileSync(path.join(state, "sidecar-8765.token"), "utf8").trim();
+    } catch {
+      // The Tauri dev shell injects its in-memory token at runtime. Plain browser dev
+      // shows the normal startup retry until the standalone server/token file exists.
+    }
+  }
+  return {
+    base: "./",
+    plugins: [react()],
+    server: { port: 1420, strictPort: true },
+    define: { __COWORKER_DEV_TOKEN__: JSON.stringify(devToken) },
+    // Tauri CLI looks for these; harmless for the browser build.
+    clearScreen: false,
+    envPrefix: ["VITE_", "TAURI_"],
+  };
+});