Windows port Phase 0: platform-select the audio backend

Make the tree compile for Windows without touching core logic, by
confining all Linux/PipeWire assumptions behind cfg gates and a single
platform-selected backend alias. No new dependencies — the cpal/WASAPI
backend lands in Phase 1; this ships a no-op stub.

- Cargo.toml: move pipewire + rfd(xdg-portal) under cfg(unix); add a
  cfg(windows) rfd using the Win32 dialog backend.
- audio: gate pipewire_impl to unix, add a cpal_impl stub for windows,
  and select between them via the new PlatformAudioBackend alias.
- core: use PlatformAudioBackend instead of the concrete PipeWireBackend.
- lib: gate the unix-only 0o600 log-file mode code (+ its test); Windows
  logs inherit the directory ACL.
- audio_probe: gate this PipeWire diagnostic to unix with a stub main.
- app: open URLs via rundll32 on windows, xdg-open on unix (shell-free).
- ci: add .gitea/workflows/windows-build.yml (M1) — build + lib tests for
  x86_64-pc-windows-msvc, with CMAKE_POLICY_VERSION_MINIMUM=3.5 for the
  vendored libopus build. Needs a windows act_runner to actually run.

Linux build/clippy/tests green (316/316). The Windows path is verified by
inspection only (no local Windows toolchain); CI is the real gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/mod.rs

@@ -1350,12 +1350,28 @@ fn update(state: &mut AppState, message: AppMessage) -> Task<AppMessage> {
             // Defence in depth: only ever hand http(s) URLs to the opener. The
             // link span's href came from `linkify`, which only emits http/https,
             // but re-check here so this can't be widened into launching arbitrary
-            // schemes/args. `xdg-open` receives the URL as a single argv entry
-            // (no shell), so there's no injection surface.
-            if (url.starts_with("http://") || url.starts_with("https://"))
-                && let Err(e) = std::process::Command::new("xdg-open").arg(&url).spawn()
-            {
-                crate::log_msg(&format!("Failed to open URL {url:?}: {e}"));
+            // schemes/args. Each opener receives the URL as a single argv entry
+            // (no shell), so there's no injection surface:
+            //   - Unix: `xdg-open <url>`.
+            //   - Windows: `rundll32 url.dll,FileProtocolHandler <url>` — opens the
+            //     default browser without going through `cmd`/`start`, which would
+            //     otherwise re-parse `&` in query strings.
+            if url.starts_with("http://") || url.starts_with("https://") {
+                let spawned = {
+                    #[cfg(unix)]
+                    {
+                        std::process::Command::new("xdg-open").arg(&url).spawn()
+                    }
+                    #[cfg(windows)]
+                    {
+                        std::process::Command::new("rundll32")
+                            .args(["url.dll,FileProtocolHandler", &url])
+                            .spawn()
+                    }
+                };
+                if let Err(e) = spawned {
+                    crate::log_msg(&format!("Failed to open URL {url:?}: {e}"));
+                }
             }
         }
         AppMessage::ToggleMicTest(enabled) => {