feat(routing): pluggable local inference (MLX, llama.cpp, LM Studio) + openhuman:// deep-link + OpenSSL 3 PKCS12 fix (#750)

* feat(routing,local-ai): pluggable local inference + openhuman:// deep-link

Salvaged from recovery commit cfb1fd9f (Apr 19) — originally auto-backed up
by claude-mem recovery tool, not yet PR'd.

## Local AI routing becomes pluggable (factory.rs, health.rs)

Previously the IntelligentRoutingProvider hard-wired Ollama as the only local
inference backend. This commit lets operators point at any OpenAI-compatible
local server (llama.cpp / llama-server, LM Studio, MLX's mlx_lm.server /
mlx-omni-server, vLLM — anything exposing /v1/chat/completions + /v1/models).

Config surface:
- `OPENHUMAN_LOCAL_INFERENCE_URL` env var — full /v1 base URL. When set,
  health is probed via GET {base}/models (OpenAI-compat) instead of Ollama's
  /api/tags.
- `LocalAiConfig.provider` accepts "llamacpp" or "llama-server" as aliases
  that default to http://127.0.0.1:8080/v1.
- Default (no env, no override) stays Ollama — zero config change for
  existing users.

Motivation: Ollama's embedded llama.cpp cannot yet load Gemma 4 E2B and
other recent models; MLX is significantly faster on Apple Silicon.
Operators should be able to pick the backend; end users see nothing.

## Deep-link scheme (Info.plist)

Adds CFBundleURLTypes entry registering `openhuman://` for the macOS bundle
so browser-issued deep links (e.g. openhuman://auth?token=...) launch the
installed app. See .claude/rules/14-deep-link-platform-guide.md for the
flow — requires a .app bundle (not `tauri dev`).

## OpenSSL 3.x PKCS12 fix (setup-dev-codesign.sh)

Adds `-legacy` to the `openssl pkcs12 -export` call. Required on OpenSSL 3.x
because the modern SHA-256 MAC / AES-256-CBC defaults are not yet supported
by macOS `security` tool, which silently fails to import the cert.

Notes:
- Dropped the CLAUDE.md.new noise and the mic-description copy downgrade
  from the original recovery commit; kept only the load-bearing changes.
- Cargo.lock files reset to upstream/main to avoid dependency drift — the
  new code does not introduce new deps.

Co-Authored-By: WOZCODE <contact@withwoz.com>

* fix(routing,codesign): address CodeRabbit review on PR #750

- setup-dev-codesign.sh: probe for openssl `-legacy` support before
  using it so older OpenSSL/LibreSSL installs don't silently fail;
  drop the stderr suppression on pkcs12 so import errors surface.
- routing/factory.rs: trim provider before alias matching, lower the
  local-inference diagnostic to `debug` and drop raw URLs from the
  log fields, and honor `OPENHUMAN_OLLAMA_BASE_URL` via the existing
  `ollama_base_url()` helper in the default Ollama branch.
- local_ai/mod.rs: re-export `ollama_base_url` for the routing factory.

* style(app/src-tauri): apply rustfmt to merged main

`cargo fmt --check` in the merge workspace flagged two hunks inherited
from upstream main:

- app/src-tauri/src/lib.rs: move `mod notification_settings;` between
  the cfg(cef) imessage_scanner and slack_scanner declarations so the
  ordering matches rustfmt's reordering output.
- app/src-tauri/src/webview_accounts/mod.rs: wrap the long
  `try_state::<NotificationSettingsState>()` binding.

No behavior change.

* format

---------

Co-authored-by: Jwalin Shah <jshah1331@gmail.com>
Co-authored-by: WOZCODE <contact@withwoz.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>

scripts/setup-dev-codesign.sh

@@ -65,13 +65,22 @@ openssl req \
   2>/dev/null
 
 # ── Bundle to PKCS12 ─────────────────────────────────────────────────────────
+# `-legacy` keeps PKCS12 MAC/encryption compatible with macOS `security` tool
+# which does not yet support OpenSSL 3.x defaults (SHA256 MAC / AES-256-CBC).
+# Older OpenSSL/LibreSSL (including the macOS-bundled LibreSSL) do not know
+# about `-legacy`, so probe for support before adding it.
+PKCS12_LEGACY_ARGS=()
+if openssl pkcs12 -help 2>&1 | grep -q -- '-legacy'; then
+  PKCS12_LEGACY_ARGS=(-legacy)
+fi
+
 openssl pkcs12 \
   -export \
+  "${PKCS12_LEGACY_ARGS[@]}" \
   -out "$P12" \
   -inkey "$KEY" \
   -in "$CERT" \
-  -passout "pass:$P12_PASS" \
-  2>/dev/null
+  -passout "pass:$P12_PASS"
 
 # ── Import into login Keychain ───────────────────────────────────────────────
 security import "$P12" \