fix(desktop): surface configuration and provider failures instead of hiding them

Several desktop paths quietly substituted defaults or partial results: a
config write could fall back to a throwaway in-memory store, speech provider
errors were absorbed into empty transcriptions, and meeting exports built
file names from raw titles.

Writes now fail explicitly when the store is unavailable, provider and model
failures reach the UI as errors, and export names pass through one
sanitizer. Settings, license, ad, and support surfaces use the shared theme
tokens, unused hotkey helpers are gone, and the package gains strict
node/renderer typecheck configs plus red-team e2e scenarios for these flows.

apps/desktop/tests/main/safe-filename.test.ts

@@ -0,0 +1,32 @@
+// tests/main/safe-filename.test.ts
+// 사용자 제목 → 파일명 조각 정규화 테스트: 금지 문자, 제어 문자, 길이 제한, 폴백.
+
+import { describe, it, expect } from 'vitest'
+import { toSafeFilenameSegment } from '../../src/main/utils/safe-filename'
+
+describe('toSafeFilenameSegment', () => {
+  it('일반 제목은 그대로 유지한다', () => {
+    expect(toSafeFilenameSegment('Weekly Sync 2026', 'meeting')).toBe('Weekly Sync 2026')
+  })
+
+  it('Windows 금지 문자와 경로 구분자를 치환한다', () => {
+    expect(toSafeFilenameSegment('a/b\\c:d*e?f"g<h>i|j%k', 'meeting')).toBe(
+      'a-b-c-d-e-f-g-h-i-j-k',
+    )
+  })
+
+  it('제어 문자를 치환한다', () => {
+    expect(toSafeFilenameSegment('line\u0000break\u001f', 'meeting')).toBe('line-break-')
+  })
+
+  it('null/빈 문자열/공백은 폴백을 반환한다', () => {
+    expect(toSafeFilenameSegment(null, 'meeting')).toBe('meeting')
+    expect(toSafeFilenameSegment(undefined, 'meeting')).toBe('meeting')
+    expect(toSafeFilenameSegment('   ', 'meeting')).toBe('meeting')
+  })
+
+  it('최대 길이로 자르고 남은 값이 없으면 잘린 폴백을 반환한다', () => {
+    expect(toSafeFilenameSegment('abcdefghij', 'meeting', 4)).toBe('abcd')
+    expect(toSafeFilenameSegment('   ', 'meeting', 4)).toBe('meet')
+  })
+})