Wallpaper from Library: CORP + shell-token wallpaper path, image thumbnails, Set as Desktop Background

[SashaMIT]

Rebased onto feat/0.7.1-models (501b411c1). The 9 wallpaper/Library commits apply with no conflicts; independent of #68.

What a person sees

• Uploading a wallpaper in System now actually changes the desktop, and System's own preview shows it.
• The System window no longer jumps when the file picker closes.
• Library shows image thumbnails instead of the generic icon (lazy, ≤ 4 MB, LRU of object URLs).
• Library's transient status lives in the footer and never pushes the toolbar controls.
• Right-click an image in Library → Set as Desktop Background. The wallpaper changes in place; System does not open.

Why the wallpaper was broken

1. The gateway enforces Cross-Origin-Embedder-Policy: require-corp; the wallpaper response carried no Cross-Origin-Resource-Policy, so the browser dropped it. Now cross-origin + nosniff.
2. Home GUI and System render from opaque sandboxed frames, so a CSS url() cannot carry the SameSite=Strict session. They now fetch with their launch token and apply an object URL (with caching, no retry storms).
3. GET /api/apps/home/appearance/background-image only accepted the Home host token; the active shell that renders the desktop was refused. It now uses require_home_active_shell_token_context, the same authority the shell already uses to write preferences. Ordinary app tokens still get 403 (tested).

Set as Desktop Background — authority model

• Library only expresses intent (home:set-desktop-background) and never gains appearance authority; a Library token calling the route directly gets 403 (tested).
• The Home host accepts the intent from library only (policy set, exact message keys, localhost://Users/ URI), performs it with its own appearance authority and refreshes the summary.
• New POST /api/apps/home/appearance/background-image { source_uri } reads the protected object itself under the caller's principal root, sniffs PNG/JPEG/WebP/GIF from the bytes, applies the same 5 MB rule and saves through the same path as the System byte upload. Foreign-principal, missing, non-image and non-localhost:// sources answer 400 (tested). Bytes never traverse a capsule.
• System's Reset still clears it; System is unchanged for this feature.

Verification

• cargo test -p elastos-server background_image (new test_home_sets_background_image_from_own_object + existing wallpaper test), fmt, clippy clean in touched files.
• home-entropy-check, library-menu-smoke, library-product-behavior-smoke, home-shell-bridge-smoke, home-gui-sign-out-smoke, home-shell-regression-smoke, product-ui-source.
• Headless end to end on a throwaway Home with a virtual passkey: upload in Library → right-click → menu item → host POST 200 → desktop repaints → System preview shows the same image.
• On feat/0.7.1-models: home-entropy-check passes at every commit, source gate 14/14, cargo clippy --workspace --all-targets -- -D warnings clean, background_image tests 2/2.

Made with Cursor

Part of #93.