fix(desktop): treat headless-serve 404 token fetch as benign

[andrexibiza]

What

Part of the coordinated close for #40680 (stale .env session token poisoning desktop auth). In headless hermes serve mode the backend never serves the SPA, so the desktop's root-URL token fetch 404s by design — yet every boot logged it as an error (could not read served dashboard token (Hermes backend): 404: Headless backend...), and the message then blamed the WebSocket token even when the real cause was a stale .env token server-side.

This PR treats the headless-serve 404 as the known-benign case it is: a new pure helper isHeadlessServeResponse() matches status 404 + body containing Headless backend / web UI disabled; when the fetch fails with that signature, resolveServedDashboardToken() returns the spawn token directly with an info-level note ([boot] headless Hermes backend: using spawn session token (no web UI served)) instead of an error log. Any other fetch failure keeps the current error+fallback behavior, and foreign-backend detection (dead child + differing served token) still throws.

Reproduction (current vs expected)

Current (pre-fix): every desktop launch in headless serve mode logged could not read served dashboard token (Hermes backend): 404: {"error":"Headless backend (hermes serve): web UI disabled — use hermes dashboard for the browser UI."} as a boot error — even on healthy launches — because the SPA is never served in headless mode. The misleading line pointed at the token fetch while the real failure (stale .env token → WS rejection) hid behind it.

Expected (post-fix): a headless launch is quiet: [boot] headless Hermes backend: using spawn session token (no web UI served) at info level. Real fetch failures (non-headless 404, network errors) still log at error level exactly as before.

How to test

cd <worktree>/apps/desktop && npx vitest run electron/dashboard-token.test.ts

New cases: (a) headless 404 → spawnToken, no error-level rememberLog; (b) non-headless 404 → error log + fallback preserved; (c) network failure unchanged; (d) headless 404 with dead child does not trip foreign-backend detection.

Platforms tested

• Windows 11 — vitest electron project, targeted file green.
• Pure TS logic; no platform-specific code touched.

Why this matters to users

Before, every desktop launch in headless mode logged a scary error line that pointed at the wrong thing — the token fetch — while the actual failure (a stale .env token) hid behind it, and the retry loop burned an hour. After, a headless launch is quiet and the log only speaks up when something is genuinely wrong.

[andrexibiza]

Superseded by #76958 — this lane's work is consolidated into the single class-closing PR. The commit(s) live on in #76958's branch; no work is lost.