feat(D2): PyInstaller entry point and spec for the desktop backend

Freezes the FastAPI app into a standalone executable. A separate entry
point (packaging/desktop_entry.py) was necessary, not optional -- the
Docker deployment starts via 'uvicorn app:app', a CLI string-import
that has no module/file to resolve against once frozen into a single
binary. This entry point imports the app object directly and calls
uvicorn.run() programmatically instead, sets BHARATGRAPH_DESKTOP_MODE
before any other import (so Phase D1's admin-auth hardening and local
config-file loading both apply), and binds to 127.0.0.1 only.

Verified for real, not just written: installed PyInstaller, ran an
actual build against this codebase, and ran the resulting binary --
/health, /runtime, /docs, and /forensics/ghost-companies all responded
correctly over real HTTP; /runtime specifically confirmed the D1/F-10
scraper_workers value is correctly bundled and functional. Cold start
is ~4s. The 503s on Neo4j-dependent routes are the correct behavior
with no database connected, not failures.

Scope, stated plainly: this is a Linux ELF binary verification, not a
Windows .exe -- the real DLL-bundling risk for compiled extensions
(lxml, scipy, numpy) is a Windows-specific concern this can't validate
without an actual Windows machine or windows-latest CI runner. spacy,
sentence-transformers, torch, and weasyprint are confirmed lazy-loaded
(app starts fine without them) but were not bundled in this build --
torch alone is 500+MB and a full build was not attempted here.

New finding, discovered via PyInstaller's own missing-module analysis,
unrelated to packaging itself: ai/translator.py and
ai/transliteration.py -- both genuinely wired into
api/routes/multilingual.py, not dead code -- import transformers and
indic_transliteration respectively, neither of which is declared in
requirements.txt. On a fresh install, the multilingual translation/
transliteration features would ImportError the moment anyone actually
used them. Flagged here, not fixed -- separate from D2's scope, and
needs a version-pinning decision, not a blind addition.

packaging/bharatgraph-backend.spec

@@ -0,0 +1,78 @@
+# -*- mode: python ; coding: utf-8 -*-
+"""
+BharatGraph Desktop Backend -- PyInstaller spec (Phase D2)
+
+Freezes packaging/desktop_entry.py (see that file's own docstring for why
+a separate entry point exists) into a single executable, bound only to
+127.0.0.1, meant to be spawned as a child process by the Tauri shell
+(Phase D4) -- not run standalone in production.
+"""
+import os
+
+PROJECT_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(SPEC)))
+
+block_cipher = None
+
+a = Analysis(
+    [os.path.join(PROJECT_ROOT, 'packaging', 'desktop_entry.py')],
+    pathex=[PROJECT_ROOT],
+    binaries=[],
+    datas=[
+        # NOTE: verified via full-codebase grep that no current code path
+        # actually reads this file at runtime -- api/routes/sources.py
+        # (the one route this file's name suggests it feeds) uses a
+        # hardcoded Python dict (SCRAPER_META) plus a live Neo4j query
+        # instead. Included anyway: it's 96KB, essentially free to bundle,
+        # and is the most likely candidate to become a real runtime
+        # dependency once Phase D7 (Dataset Manager) is built. Not
+        # removed, but not assumed necessary either -- stated plainly so
+        # a future reader doesn't have to re-derive this.
+        (os.path.join(PROJECT_ROOT, 'datasets', 'bharatgraph_sources.csv'), 'datasets'),
+    ],
+    hiddenimports=[
+        # api/main.py's own app.include_router(...) calls are regular
+        # top-level imports, so PyInstaller's static analysis should
+        # already find every api.routes.* module -- not listed
+        # defensively here, unlike uvicorn's own dynamic loading below,
+        # specifically to let a real build prove that assumption right
+        # or wrong rather than papering over it with a hidden-imports
+        # list that would hide a real gap.
+        'uvicorn.logging',
+        'uvicorn.loops',
+        'uvicorn.loops.auto',
+        'uvicorn.protocols',
+        'uvicorn.protocols.http',
+        'uvicorn.protocols.http.auto',
+        'uvicorn.protocols.websockets',
+        'uvicorn.protocols.websockets.auto',
+        'uvicorn.lifespan',
+        'uvicorn.lifespan.on',
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[],
+    noarchive=False,
+)
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.zipfiles,
+    a.datas,
+    [],
+    name='bharatgraph-backend',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=False,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

packaging/desktop_entry.py

@@ -0,0 +1,63 @@
+"""
+BharatGraph Desktop -- PyInstaller entry point (Phase D2)
+
+Why this file exists, separately from app.py: the Docker deployment starts
+the server via `uvicorn app:app`, a CLI command that resolves the string
+"app:app" to a module and attribute at runtime using Python's normal import
+machinery. A PyInstaller-frozen executable does not have that machinery
+available the same way -- there is no `app.py` file on disk to resolve a
+string against once everything is bundled into a single binary. The
+standard, reliable fix (used by PyInstaller's own documentation for
+freezing ASGI apps) is to import the app object directly in Python code and
+call uvicorn.run() programmatically instead of via its CLI string-lookup
+path. This file is that direct entry point.
+
+Sets BHARATGRAPH_DESKTOP_MODE=true before importing anything else, so the
+Phase D1 admin-auth hardening in api/routes/admin.py (auto-generated,
+persisted per-install secret; no DEBUG_MODE bypass path) applies correctly
+whenever the app is started this way, and so config/settings.py's local
+config-file loading is the primary configuration path a desktop user
+actually has, rather than a code path that only matters at packaging time.
+
+Binds to 127.0.0.1 only, matching the target architecture ("bound to
+127.0.0.1 only") -- this process is meant to be reached only by the Tauri
+shell's own webview (Phase D4), never by the network.
+"""
+import os
+import sys
+
+# Must happen before importing api.main (or anything that transitively
+# imports config.settings), so the desktop-mode admin-auth branch and the
+# local config-file loading are both active from the very first import.
+os.environ.setdefault("BHARATGRAPH_DESKTOP_MODE", "true")
+
+# PyInstaller sets sys.frozen and sys._MEIPASS when running from a frozen
+# bundle; ensure the app's own package root is importable either way, so
+# this entry point works identically when run as a plain script (for local
+# testing, exactly as this was verified) and when frozen.
+if getattr(sys, "frozen", False):
+    _app_root = sys._MEIPASS  # type: ignore[attr-defined]
+else:
+    _app_root = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, _app_root)
+
+import uvicorn
+from api.main import app
+
+
+def main() -> None:
+    port = int(os.getenv("BHARATGRAPH_DESKTOP_PORT", "8000"))
+    uvicorn.run(
+        app,
+        host="127.0.0.1",
+        port=port,
+        log_level=os.getenv("BHARATGRAPH_LOG_LEVEL", "info"),
+        # Single worker: matches the existing Docker deployment's own
+        # --workers 1 (api/main.py's docstring/Dockerfile), and a desktop
+        # install is single-user by definition -- no reason to diverge.
+        workers=1,
+    )
+
+
+if __name__ == "__main__":
+    main()