Standalone Shonar Desktop: vendor portable sources + local engine; decouple from ~/Projects/Shonar

- shared/ = portable Android-origin sources vendored from deferred/desktop-server
  (app/build.gradle.kts srcDir repointed; PlaybackController.kt excluded as Android-only)
- backend/ = bundled-lite engine (SQLite + inline queue); .venv symlinked from the
  old checkout, PYTHONPATH pins THIS backend's code over any editable install
- repoRoot() resolves this project dir (env SHONAR_REPO still wins); desktop-dev.sh
  watches shared/ + backend/
- Verified: :app:compileKotlin + :app:test green (23 tests); engine boots on :8010,
  self-migrates, /healthz ok

backend/shonar/api/v1/provider_info.py

@@ -0,0 +1,38 @@
+"""Public provider handshake.
+
+`GET /api/v1/provider-info` lets SHONAR clients (and platform probes on
+Start9/Umbrel) identify this server as SHONAR-compatible and learn its
+capabilities BEFORE any credentials are involved. Returns static deployment
+metadata only — never user data, never configuration secrets.
+"""
+
+from __future__ import annotations
+
+from fastapi import APIRouter
+
+from shonar import __version__
+from shonar.core.config import get_settings
+
+router = APIRouter(tags=["provider"])
+
+
+@router.get("/provider-info")
+async def provider_info() -> dict:
+    """Static, unauthenticated deployment identity for client probing."""
+    settings = get_settings()
+    # Capability flags reflect what this deployment can actually do right now.
+    transcription = settings.transcription_provider != "none"
+    llm = settings.llm_provider != "none"
+    return {
+        "kind": "shonar",
+        "version": __version__,
+        "api_version": "v1",
+        "capabilities": {
+            "chunked_upload": True,
+            "server_transcription": transcription,
+            "server_summary": llm,
+            "account_deletion": True,
+        },
+        # Storage backend family (never a path): "local" | "s3"
+        "storage_backend": settings.storage_backend,
+    }