feat(settings): configurable Hermes download sources

[YoLin02]

Summary

• add a real Settings > Advanced surface for Hermes archive, Node.js, npm, Python and npm registry sources
• persist the complete non-secret configuration through authenticated daemon APIs with mainland-China defaults
• prefer verified MSI-bundled Hermes/Node/npm artifacts and use configured HTTPS fallbacks only when packaged artifacts are absent
• keep exact compiled size/SHA-256 pins, strip inherited registry/secrets, and snapshot settings at Operation start
• reduce and center the default desktop window for lower-resolution displays
• record ADR-0010, Phase 3 Amendment 003A7, implementation evidence, and correct the stale Phase 6 roadmap status

Local verification

• pnpm audit --audit-level low
• pnpm api:lint
• desktop typecheck
• desktop lint
• desktop tests: 22 files / 102 tests
• desktop production build
• git diff --check

Pending gates

This is intentionally a draft until GitHub Actions validates the repository-pinned Go, Rust, Node and pnpm toolchains. Phase 6's independent audit and owner-authenticated Windows Weixin/WeCom smoke also remain pending and are not claimed by this correction.