feat: Electron desktop app, native ffmpeg export, fully static web

- apps/desktop: Electron shell serving the static web build over a
  privileged opencut:// protocol; exports stream frames over IPC to a
  bundled ffmpeg (libx264/libvpx-vp9, BT.709 tagged) with backpressure.
  electron-builder packaging: AppImage, deb, rpm.
- apps/web: dead backend deleted (better-auth, drizzle/pg, upstash,
  botid, freesound proxy, blog, rss, env validation); next build emits
  a zero-env static export; /editor/[project_id] -> /editor?project=.
- Native exporter mirrors SceneExporter; activates when the preload
  bridge is present; web keeps the mediabunny path.
- Docker self-hosting now builds and serves the static export via nginx.
- Release workflow: v* tags publish static web tarball + Linux packages.
- Changelog 0.4.0; README/AGENTS/CONTRIBUTING/roadmap updated.
- GPUI/Rust rewrite parked on branch rust-rewrite.

2 files changed, 56 insertions, 11 deletions

diff --git a/.github/workflows/bun-ci.yml b/.github/workflows/bun-ci.yml
index 8f702f72..ed79742f 100644
--- a/.github/workflows/bun-ci.yml
+++ b/.github/workflows/bun-ci.yml
@@ -21,17 +21,6 @@ jobs:
       matrix:

         os: [ubuntu-latest, windows-latest, macos-latest]

 

-    env:

-      DATABASE_URL: "postgresql://opencut:opencut@localhost:5432/opencut"

-      BETTER_AUTH_SECRET: "supersecret"

-      NEXT_PUBLIC_SITE_URL: "http://localhost:3000"

-      UPSTASH_REDIS_REST_URL: "https://your-upstash-redis-url"

-      UPSTASH_REDIS_REST_TOKEN: "your-upstash-redis-token"

-      NEXT_PUBLIC_MARBLE_API_URL: "https://placeholder.example.com"

-      MARBLE_WORKSPACE_KEY: "placeholder"

-      FREESOUND_CLIENT_ID: "placeholder"

-      FREESOUND_API_KEY: "placeholder"

-    

     steps:

       - name: Checkout repository

         uses: actions/checkout@v4

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..0469fc3a
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,56 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76
+        with:
+          bun-version: 1.2.18
+
+      - name: Cache Bun modules
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-1.2.18-${{ hashFiles('bun.lock') }}
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Build web app (static export)
+        run: bun build:web
+
+      - name: Package static web bundle
+        working-directory: apps/web
+        run: tar -czf ../../opencut-web-static.tar.gz -C out .
+
+      - name: Copy web bundle into desktop app
+        working-directory: apps/desktop
+        run: bun run copy:web
+
+      - name: Build desktop packages (AppImage, deb, rpm)
+        working-directory: apps/desktop
+        run: bun run dist
+
+      - name: Upload release assets
+        uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: |
+            opencut-web-static.tar.gz
+            apps/desktop/release/OpenCut-*-linux-*.AppImage
+            apps/desktop/release/OpenCut-*-linux-*.deb
+            apps/desktop/release/OpenCut-*-linux-*.rpm