feat: store launcher state outside game dirs

Move launcher-owned metadata from game roots into the configured peer state
area. Peer identity, the local library index, install intent logs, and setup
markers now live under app/CLI state instead of being written beside games.
The Tauri shell passes its app data directory into the peer, and the peer CLI
runs the same path through its explicit --state-dir.

Add a dedicated pre-start migration phase for legacy files. It migrates the
old global library index, per-game install intents, and the old first-start
marker into app state, then deletes legacy files only after the replacement
write succeeds. Normal scan, install, recovery, and transfer paths no longer
read legacy state files.

Rename the old first-start meaning to setup_done and only set it after
launching game_setup.cmd. Start/setup scripts keep the shared argument shape,
while server_start.cmd now uses cmd /k and a visible window so server logs stay
open for inspection.

While validating the Docker scenario matrix, make download terminal events
come from the handler after local state refresh and operation cleanup. This
makes download-finished/download-failed safe points for immediate follow-up CLI
commands. Also update the multi-peer chunking scenario to use a sparse archive
large enough to actually span multiple production chunks.

Test Plan:
- just fmt
- just test
- just frontend-test
- just build
- just clippy
- git diff --check
- python3 crates/lanspread-peer-cli/scripts/run_extended_scenarios.py

Refs: local app-state migration discussion

crates/lanspread-peer/README.md

@@ -97,16 +97,21 @@ truth for whether a download is still running.
 
 Install, update, uninstall, downloaded-file removal, and startup recovery live
 under `src/install/`.
-Each game root has an atomic `.lanspread.json` intent log for install-side
-operations and uses Lanspread-owned `.local.installing/` and `.local.backup/`
-directories marked by `.lanspread_owned`. Startup recovery combines the recorded
-intent with the observed filesystem state and only deletes reserved directories
-when intent or marker ownership proves they belong to Lanspread.
+Install-side operation intent is stored atomically under the configured peer
+state directory, at `games/<game_id>/install_intent.json`. Game roots still use
+Lanspread-owned `.local.installing/` and `.local.backup/` directories marked by
+`.lanspread_owned`. Startup recovery combines the recorded intent with the
+observed filesystem state and only deletes reserved directories when intent or
+marker ownership proves they belong to Lanspread.
 Downloaded-file removal is deliberately separate from uninstall: it only accepts
 catalog IDs that are direct children of the configured game directory, refuses
 installed or in-flight roots, and deletes the whole game root only after finding
 a regular root-level `version.ini` sentinel.
 
+Legacy launcher-owned files in game directories are migrated by a dedicated
+pre-start phase. Normal install, recovery, scan, and transfer paths use only the
+configured state directory for launcher-owned metadata.
+
 ## Integration with `lanspread-tauri-deno-ts`
 
 The Tauri application embeds this crate in