feat: download dirs, file transfer resume, Wails desktop app, PWA, CI

Daemon:
- Per-network download directories (-download-dir flag, set_download_dir IPC)
- File transfer resume after disconnection: .tmp.meta sidecars survive
  interruption; resume_offset in file-accept lets sender seek and continue
- set_download_dir IPC command; download_dir reported in state_snapshot

Protocol:
- PeerMessage.ResumeOffset (EXT-006) for file transfer resume
- IpcMessage.ShareNetworks json tag changed from "networks" to "network_ids"
  to fix duplicate json tag collision with Networks []NetworkInfo

Desktop app (cmd/app):
- Wails v2 shell embedding daemon logic directly (no subprocess)
- System tray on Linux/Windows via getlantern/systray; macOS hides to Dock
- OS notifications for message_received and file_complete via Wails events
- notray build tag for headless/CI builds without GTK tray headers
- build-app.sh: builds web frontend, copies dist, runs wails build

Web / PWA:
- manifest.json + Apple touch icon meta tags for mobile "Add to Home Screen"
- PNG icons (192px, 512px, 180px) generated from SVG
- Wails EventsOn("notify") hook in App.tsx for native OS notifications

CI:
- .gitea/workflows/build.yml: server binaries cross-compiled for 5 platforms,
  desktop app for Linux amd64, release artifacts published on v* tags

Docs:
- README: download dir, file transfer resume, desktop app, PWA, CI sections
- EXTENSIONS.md: EXT-004 daemon mode marked shipped; EXT-006 resume added
- FUTURE.md: roadmap updated

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -185,6 +185,8 @@ A user visits your domain, enters their name and a network name, and joins. Invi
 
 **Identity note:** browser mode uses the master identity directly (same keypair on all networks, compatible with yaw2). The daemon derives a separate keypair per network via HKDF. A browser user and a daemon user on the same network will see each other and can chat — they just appear as different peers even if they're the same person.
 
+**Mobile:** the web UI ships a PWA manifest (`manifest.json`) so iOS and Android users can pin it to their home screen via "Add to Home Screen" in Safari or Chrome. It runs as a standalone app with no browser chrome. No app store, no native install required.
+
 **Session persistence:** the last-used network name, alias, and anchor URL are saved to `localStorage`. On reload, the browser automatically rejoins the saved network — no login screen. To leave a network or switch identity, click the **⏻** button in the top-left of the sidebar. You'll be asked whether to also clear the identity keypair (export a backup first if you want to keep it).
 
 ### Daemon mode (for users running the daemon locally)
@@ -215,8 +217,80 @@ Hover over a peer in the sidebar to reveal action buttons. Click **⊞** to requ
 
 Hover over a peer and click **📎** to open a file picker. The selected file is pushed immediately to that peer — they don't need to be sharing anything. The recipient's browser auto-downloads the file on arrival.
 
+### Transfer resume (daemon mode)
+
+When a file transfer is interrupted mid-stream — peer disconnects, network drops — the partially-received data is kept on disk. A `.meta` sidecar is written alongside each in-progress `.tmp` file recording the file name, size, and SHA-256.
+
+When the peer reconnects and re-offers the same file, the daemon finds the matching partial by SHA-256, sends back a `file-accept` with a non-zero `resume_offset`, and the sender seeks to that byte position before streaming. The receiver appends to the existing file and verifies the full SHA-256 at the end.
+
+Corrupted transfers (all bytes received but hash mismatch) are removed. Interrupted transfers are kept indefinitely until either successfully completed or the `.tmp`/`.meta` files are manually deleted.
+
 > In daemon mode, use `add_share` / `remove_share` via IPC to manage share roots. Share configuration is stored in `shares.json` next to `identity.json` in the data directory and survives restarts. `networks: ["*"]` makes a share visible on all networks; omit to scope it to specific network IDs. The legacy `set_share_dir` single-dir command still works alongside it.
 
+### Daemon download directory
+
+Received files are saved into a per-network subdirectory so networks stay isolated. By default this is inside the data directory:
+
+```
+~/.waste/downloads-<network-id>/
+```
+
+Pass `-download-dir` at startup to use a different base:
+
+```bash
+go run ./cmd/daemon -download-dir ~/Downloads ...
+```
+
+Files then land in `~/Downloads/downloads-<network-id>/`. The path can also be changed at runtime via the `set_download_dir` IPC command (takes effect for the next incoming transfer on that network). The current path is reported in every `state_snapshot` event under `networks[].download_dir`.
+
+---
+
+## Desktop app (Wails)
+
+`cmd/app/` is a [Wails v2](https://wails.io) shell that packages the React frontend and the daemon logic into a single native binary for Windows, macOS, and Linux. No Rust, no Electron — just Go + the OS webview.
+
+The daemon runs embedded in the same process. The webview connects to `ws://127.0.0.1:17338` exactly as it does in browser-daemon mode, so the frontend code is unchanged. Identity and stores use the OS config directory (`~/Library/Application Support/waste` on macOS, `~/.config/waste` on Linux, `%APPDATA%\waste` on Windows).
+
+### Prerequisites
+
+- Go 1.24+
+- Node.js 20+
+- Wails CLI: `go install github.com/wailsapp/wails/v2/cmd/wails@latest`
+- Linux platform deps: `sudo apt-get install libgtk-3-dev libwebkit2gtk-4.0-dev libayatana-appindicator3-dev`
+
+### Build
+
+```bash
+# Production build → dist/waste-linux-amd64 (or waste.exe / waste.app)
+./build-app.sh
+
+# Dev mode (hot-reload; start Vite in another terminal: cd web && npm run dev)
+./build-app.sh dev
+
+# Build without system tray (no libayatana-appindicator3-dev needed)
+CGO_ENABLED=1 WAILS_TAGS=notray ./build-app.sh
+```
+
+`build-app.sh` builds the React frontend, copies `web/dist/` into `cmd/app/frontend/dist/` for embedding, then runs `wails build`. The result is a single self-contained binary.
+
+### What the desktop app provides
+
+- **Single binary** — daemon logic is embedded, no subprocess to manage
+- **System tray** (Linux/Windows) — hide to tray, reopen from tray menu, Quit
+- **macOS** — hides to Dock on window close; full menu-bar tray is future work
+- **OS notifications** — native popup on new message or completed file transfer (uses the browser `Notification` API via Wails events; the app will request permission on first notification)
+- **Data directory** — OS-appropriate config dir (`~/.config/waste`, `~/Library/Application Support/waste`, `%APPDATA%\waste`)
+
+### CI / automated builds
+
+`.gitea/workflows/build.yml` runs on every `v*` tag push:
+
+- **Server binaries** (daemon + anchor): cross-compiled for Linux amd64/arm64, macOS amd64/arm64, Windows amd64 — no CGo, no special runner needed
+- **Desktop app**: Linux amd64 on the default runner (installs GTK + WebKit + appindicator deps automatically)
+- **Releases**: all artifacts attached to the Gitea release
+
+To add macOS or Windows desktop builds, add self-hosted Gitea runners on those platforms and mirror the `desktop-linux` job.
+
 ---
 
 ## Local development
@@ -338,18 +412,20 @@ Newline-delimited JSON on TCP port 17337 (or WebSocket on 17338).
 {"type":"get_file_list"}
 {"type":"get_file_list","peer_id":"<64-hex>"}
 {"type":"send_file","peer_id":"<64-hex>","path":"notes.txt"}
-{"type":"add_share","path":"/home/alice/Music"}                        // global share
-{"type":"add_share","path":"/home/alice/Docs","networks":["abc123"]}   // network-scoped
+{"type":"add_share","path":"/home/alice/Music"}                                 // global share
+{"type":"add_share","path":"/home/alice/Docs","network_ids":["abc123"]}        // network-scoped
 {"type":"remove_share","path":"/home/alice/Music"}
 {"type":"list_shares"}
 {"type":"create_room","room":"dev"}
+{"type":"set_download_dir","path":"/home/alice/Downloads"}               // change download base for current network
+{"type":"set_download_dir","network_id":"<16-hex>","path":"/home/alice/Downloads/friends"}
 {"type":"export_identity","passphrase":"..."}
 {"type":"import_identity","passphrase":"...","backup":"..."}
 ```
 
 **Events:**
 ```jsonc
-{"type":"state_snapshot","local_peer":{...},"connected_peers":[...],"master_alias":"alice","master_id":"<64-hex>"}
+{"type":"state_snapshot","local_peer":{...},"connected_peers":[...],"master_alias":"alice","master_id":"<64-hex>","networks":[{"network_id":"...","network_name":"friends","share_dir":"...","download_dir":"..."}]}
 {"type":"peer_connected","peer":{"id":"<64-hex>","alias":"bob"}}
 {"type":"session_ready","peer_id":"<64-hex>","nick":"bob"}
 {"type":"peer_disconnected","peer_id":"<64-hex>"}