desktop is a plugin too

Its sidecar, officer-vnc, was already excluded from the light profile, so calling
it core was only the capability kind saying `execution` — which is about who may
reach it, not whether a light install runs it.

Unmounted the same way as the other twelve: `/desktop`, its capability's api and
ws claims, the `desktop` websocket handler and its upgrade route. Implementation
untouched.

Also reverts a mistake from the previous commit. I had commented entries out of
WSData's `provider` union and left `upgradeWs`'s parameter type listing them,
which would have been a type error the moment either was used — and one I cannot
see here, since node_modules is empty and tsgo does not run. Those unions describe
possible values rather than what is served, and neither is a registration. Only
registrations are commented now, which is what was asked for in the first place.

Totality simulated again: 33 live mounts, 5 websockets, zero problems.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/server.tsx

@@ -15,7 +15,7 @@ import { chatWebsocket } from './servers/api/chat/websocket';
 import { taskRunnerWebsocket } from './servers/api/tasks/task-executor';
 import { pipelineWebsocket } from './servers/api/tasks/pipeline-executor';
 import { cliampWebsocket, cliampAudioWebsocket } from './servers/api/cliamp/relay';
-import { desktopWebsocket } from './servers/api/desktop/websocket';
+// import { desktopWebsocket } from './servers/api/desktop/websocket';
 // import { vaultWebsocket, upgradeVaultWs } from './servers/api/vault/websocket';
 import officerWeb from './apps/officer-web/index.gen.html';
 // import { startBrowserRelay } from './servers/api/browser/relay';  // switched off — see below
@@ -41,10 +41,10 @@ type WSData = {
     | 'chat'
     | 'task-runner'
     | 'pipeline'
-    // | 'cliamp'
-    // | 'cliamp-audio'
+    | 'cliamp'
+    | 'cliamp-audio'
     | 'desktop'
-    // | 'vault'
+    | 'vault'
     | 'sidecar';
   sessionId?: string;
   cwd?: string;
@@ -137,7 +137,7 @@ const handlers: Record<string, any> = {
   pipeline: pipelineWebsocket,
   // cliamp: cliampWebsocket,
   // 'cliamp-audio': cliampAudioWebsocket,
-  desktop: desktopWebsocket,
+  // desktop: desktopWebsocket,
   // vault: vaultWebsocket,
   sidecar: sidecarWebsocket,
 };
@@ -295,7 +295,7 @@ const server = serve({
     '/api/chat/ws': (req, server) => upgradeWs(req, server, 'chat'),
     '/api/cliamp/ws': (req, server) => upgradeWs(req, server, 'cliamp'),
     '/api/cliamp/audio/ws': (req, server) => upgradeWs(req, server, 'cliamp-audio'),
-    '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
+    // '/api/desktop/ws': (req, server) => upgradeWs(req, server, 'desktop'),
     // CalDAV/CardDAV. These live OUTSIDE /api because DAV clients are given a bare domain and probe
     // fixed, spec-defined paths — `/.well-known/caldav` unauthenticated, before they hold any
     // credential at all. They need naming explicitly here or the `/*` SPA fallback below swallows them