feat: Phase 2+5 — IPC security hardening, @electron/remote removal, Electron 18→34

Phase 2 — contextBridge IPC bridge:
- Add src/main/preload.ts (contextBridge.exposeInMainWorld, window.api)
- Add src/main/ipc/windowBridge.js (IPC handlers replacing @electron/remote)
- src/main/config.js: contextIsolation:true, nodeIntegration:false
- Migrate all 39 renderer files: ipcRenderer.* → window.api.ipc.*
- Migrate @electron/remote usages in renderer (nativeTheme, window ops, app.getPath)

Phase 5 — Electron 18 → 34:
- Remove @electron/remote entirely from main process (index.js, editor.js, setting.js)
- app.on('ready') → app.whenReady().then() (app/index.js, index.dev.js)
- src/main/config.js: remove webpack __preload artifact, use path.join(__dirname)
- package.json: electron ^18 → ^34, remove @electron/remote dep,
  electron-rebuild@3 → @electron/rebuild@4 (C++20 support for Electron 34)

Native modules rebuilt with @electron/rebuild -f (ced, keytar, native-keymap).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>