feat(tauri-app): Tauri 2 capabilities default + open_devtools in debug

The dev build was missing a capabilities/default.json so the
event:listen and notification:is-permission-granted plugins
denied every IPC call from main.ts (logged as 'event.listen not
allowed' etc. in DevTools). Add the minimum set needed by
client.ts / main.ts and the AppView/Tauri commands registered
in lib.rs.

Also open the webview devtools automatically on startup behind
a debug_assertions guard, so the frontend console + DOM inspector
are available without reaching for the macOS View menu.

crates/tauri-app/src-tauri/capabilities/default.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Default capabilities for the maarcadetweet main window",
+  "windows": ["main"],
+  "permissions": [
+    "core:default",
+    "core:event:default",
+    "core:webview:allow-internal-toggle-devtools",
+    "core:window:default",
+    "notification:default",
+    "shell:default",
+    "dialog:default",
+    "updater:default",
+    "window-state:default"
+  ]
+}

crates/tauri-app/src-tauri/src/lib.rs

@@ -559,6 +559,15 @@ pub fn run() {
             use tauri::Manager;
             tracing::info!("maarcadetweet starting up");
 
+            // Open the webview devtools on startup in debug builds so
+            // we can see the console + DOM inspector without reaching
+            // for the macOS menu. The production build has no debug
+            // assertions so this branch is a no-op there.
+            #[cfg(debug_assertions)]
+            if let Some(win) = app.get_webview_window("main") {
+                let _ = win.open_devtools();
+            }
+
             // Embed the tray icon at compile time. `include_image!`
             // resolves paths relative to `CARGO_MANIFEST_DIR` and
             // bakes the raw RGBA pixels into the binary, so the

crates/tauri-app/src-tauri/tauri.conf.json

@@ -28,7 +28,8 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ipc: http://ipc.localhost"
+      "csp": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' ipc: http://ipc.localhost",
+      "capabilities": ["default"]
     }
   },
   "plugins": {