feat: 巡检增强 / 拓扑大屏 / 远程 HTTP / portable 绿色打包

巡检模块：巡检调度器改为轮询驱动，新增每日报告存储、告警规则独立
Store、设备 Store 解耦，_executeSnapshot 补齐 DEBUG 声明，巡检中心
与告警中心页增强。

拓扑大屏：MonitoringTopologyView 扩展分组/布局控制，
useMonitoringData 重构数据流。

远程 HTTP：新增 electron/remoteHttpServer.cjs，preload/api.cjs 暴露
IPC，registerBridges 注册 netcatty:http:open 桥。

portable 绿色打包：
- electron-builder.config.cjs 恢复原始白名单（61MB app.asar），
  收集器自动追踪运行时依赖；
- portableData.cjs 重写为 .portable 标记检测；
- scripts/migratePortableLocalStorage.cjs 离线脚本把 Local Storage
  的 http://localhost:5173 origin 批量迁移为 app://netcatty；
- scripts/scanWorkspaceDeps.cjs 扫描 workspace 运行时依赖。

electron-builder.config.cjs

@@ -1,10 +1,18 @@
+const path = require('node:path');
 const { moshExtraResources } = require('./scripts/mosh-extra-resources.cjs');
 const { etExtraResources } = require('./scripts/et-extra-resources.cjs');
+// 说明：electron-builder 依赖收集器在 monorepo/workspace 项目里会漏掉
+// workspace 子包引用但根 package.json 没声明的运行时依赖（hoist 上来的），
+// 且追踪传递依赖时容易漏包。这里直接把整个 node_modules 目录纳入 files，
+// 确保运行时 require 什么都能找到。用排除列表去掉前端/构建工具/文档/测试代码。
 
 /**
  * @type {import('electron-builder').Configuration}
  */
 module.exports = {
+    // 内网环境下 electron-builder 默认会去 github.com 下载 Electron zip。
+    // 强制指向本地已解压的 node_modules/electron/dist，跳过联网。
+    electronDist: path.join(__dirname, 'node_modules', 'electron', 'dist'),
     appId: 'com.netcatty.app',
     productName: 'NetMesh',
     artifactName: '${productName}-${version}-${os}-${arch}.${ext}',
@@ -50,117 +58,19 @@ module.exports = {
         output: 'release'
     },
     files: [
-        'dist/**/*',
-        'electron/**/*',
-        // The Windows Hello helper is shipped once through win.extraResources.
-        // Exclude local per-arch build output from app.asar on every platform.
-        '!electron/bridges/windowsHelloHelper/build/**/*',
-        // Runtime smoke fixtures are built test packages, not host resources.
-        // Keep them out of production ASARs so no example plugin can be
-        // mistaken for an installed or host-trusted package.
-        '!electron/plugins/fixtures/**/*',
-        // Main-process terminal flow control reads shared thresholds from here
-        // (terminalFlowAck.cjs). Must ship beside electron/ in app.asar.
-        'infrastructure/config/terminalFlowConstants.cjs',
-        'infrastructure/config/terminalFlowConstants.json',
-        // Renderer and Mosh's main-process bootstrap share the same
-        // fail-closed prompt classifier at runtime.
-        'domain/terminalPromptSecurity.shared.cjs',
-        'lib/**/*.cjs',
-        'lib/**/*.json',
-        'skills/**/*',
-        '!public/**/*',
-        '!**/*.map',
-        '!**/*.d.ts',
-        '!**/*.d.mts',
-        '!**/*.d.cts',
-        '!**/*.ts',
-        '!**/*.tsx',
-        '!**/*.test.*',
-        '!**/*.spec.*',
-        '!**/__tests__/**/*',
-        '!**/test/**/*',
-        '!**/tests/**/*',
-        '!**/example/**/*',
-        '!**/examples/**/*',
-        '!node_modules/**/docs/**/*',
-        '!node_modules/**/doc/**/*',
-        '!node_modules/**/benchmark/**/*',
-        '!node_modules/**/benchmarks/**/*',
-        // Renderer-only packages are compiled into dist by Vite. Keep them
-        // installed for npm run dev/build, but do not ship the duplicate source
-        // packages in release artifacts.
-        '!node_modules/@fontsource/**/*',
-        '!node_modules/@monaco-editor/**/*',
-        '!node_modules/@radix-ui/**/*',
-        '!node_modules/@xterm/**/*',
-        '!node_modules/lucide-react/**/*',
-        '!node_modules/monaco-editor/**/*',
-        '!node_modules/react/**/*',
-        '!node_modules/react-dom/**/*',
-        '!node_modules/ai/**/*',
-        '!node_modules/@ai-sdk/**/*',
-        '!node_modules/@mdxeditor/**/*',
-        '!node_modules/streamdown/**/*',
-        '!node_modules/@streamdown/**/*',
-        '!node_modules/@tanstack/react-virtual/**/*',
-        '!node_modules/pinyin-pro/**/*',
-        '!node_modules/re2js/**/*',
-        '!node_modules/@eslint-community/regexpp/**/*',
-        '!node_modules/clsx/**/*',
-        '!node_modules/tailwind-merge/**/*',
-        '!node_modules/use-stick-to-bottom/**/*',
-        '!node_modules/lexical/**/*',
-        '!node_modules/@lexical/**/*',
-        '!node_modules/@codemirror/**/*',
-        '!node_modules/katex/**/*',
-        '!node_modules/shiki/**/*',
-        '!node_modules/@shiki/**/*',
-        // Heavy cloud completion specs are intentionally not bundled. The main
-        // process filters the same prefixes so dev and packaged builds behave
-        // consistently.
-        '!node_modules/@withfig/autocomplete/build/aws.js',
-        '!node_modules/@withfig/autocomplete/build/aws/**/*',
-        '!node_modules/@withfig/autocomplete/build/gcloud.js',
-        '!node_modules/@withfig/autocomplete/build/gcloud/**/*',
-        '!node_modules/@withfig/autocomplete/build/az/**/*',
-        // Fig specs are already compiled JavaScript; TypeScript is only pulled
-        // in by Fig helper packages as build tooling and is not needed at app
-        // runtime.
-        '!node_modules/typescript/**/*',
-        // ── Exclude per-platform native agent binaries (~100s of MB each). ──
-        // Netcatty is "bring your own CLI": each SDK is pointed at the user's
-        // system-installed CLI via an absolute path override (claude
-        // pathToClaudeCodeExecutable / codex codexPathOverride / copilot cliPath).
-        // Only the SDKs' JS is bundled; the heavy per-arch binaries are dropped.
-        // NOTE: claude-agent-sdk vendors the `claude` binary as a NESTED package
-        // (claude-agent-sdk/node_modules/@anthropic-ai/claude-agent-sdk-<arch>),
-        // so this exclusion must match at any depth (**/), not just top-level.
-        // The codex/copilot exclusions target only the per-arch binary packages
-        // (codex-<arch> / copilot-<arch>) — NOT @openai/codex-sdk / copilot-sdk,
-        // whose JS we DO bundle. @github/copilot is the full ~288MB CLI (with
-        // per-platform prebuilds); netcatty uses the user's copilot via cliPath,
-        // so it is excluded entirely.
-        '!**/@anthropic-ai/claude-agent-sdk-*/**/*',
-        '!node_modules/@anthropic-ai/claude-code-*/**/*',
-        '!node_modules/@openai/codex-{darwin,linux,linuxmusl,win32}-*/**/*',
-        '!node_modules/@github/copilot-{darwin,linux,linuxmusl,win32}-*/**/*',
-        '!node_modules/@github/copilot/**/*',
-        '!node_modules/opencode-{darwin,linux,linuxmusl,windows}-*/**/*',
-        '!node_modules/opencode-ai/**/*',
-        // CodeBuddy follows the same first-party integration model as the
-        // other coding agents: Netcatty discovers and passes the user's
-        // installed CLI path to the SDK. Keep the small SDK wrapper, but do not
-        // bundle the full CodeBuddy CLI payload (rg vendors + web UI).
-        '!node_modules/@tencent-ai/agent-sdk/cli/**/*',
-        // Netcatty loads Cursor SDK through ESM dynamic import, so the duplicate
-        // CommonJS build and type metadata are not needed at runtime.
-        '!node_modules/@cursor/sdk/dist/cjs/**/*',
-        '!node_modules/@cursor/sdk/dist/**/*.d.ts',
-        '!node_modules/@cursor/sdk/dist/**/*.d.ts.map',
-        // sqlite3 rebuilds a native module for Electron; its upstream source
-        // tarball is build-time payload only.
-        '!node_modules/sqlite3/deps/**/*'
+    // electron-builder 收集器只读根 package.json，但 workspace 子包的运行时依赖
+    // 会 hoist 到根 node_modules 却没在根 package.json 里声明。
+    // 收集器会漏掉这些包，所以把漏的补进根 package.json 后它就能追踪完整传递依赖树。
+    "dist/**/*",
+    "electron/**/*",
+    "!electron/bridges/windowsHelloHelper/build/**/*",
+    "!electron/plugins/fixtures/**/*",
+    "infrastructure/config/terminalFlowConstants.cjs",
+    "infrastructure/config/terminalFlowConstants.json",
+    "domain/terminalPromptSecurity.shared.cjs",
+    "lib/**/*.cjs",
+    "lib/**/*.json",
+    "skills/**/*"
     ],
     asarUnpack: [
         'node_modules/node-pty/**/*',