feat: register cockatrice:// and cockatrice-oracle:// protocol handlers

Adds OS-level URL-scheme handlers so users can click a link in a browser,
chat client, or third-party tool to launch Cockatrice straight into a
server / game / Oracle update.

Supported URL forms:
  cockatrice://joingame?hostname=H&port=P&roomid=R&gameid=G[&spectate=1]
  cockatrice-oracle://update[?spoilers=1]

Credentials passed via URL (username/password query params) are deliberately
ignored — URLs leak through shell history, browser history, EDR capture, etc.
If the target server requires auth and no saved credentials match, the Connect
dialog opens pre-filled with the URL's host/port so the user types their
password locally.

OS integration
- Linux: MimeType=x-scheme-handler/cockatrice (and -oracle) added to the
  .desktop files; Exec=cockatrice %u passes the URL through.
- Windows: NSIS installer writes HKCR\cockatrice and HKCR\cockatrice-oracle
  registry entries; uninstaller removes them.
- macOS: per-app Info.cockatrice.plist / Info.oracle.plist declare
  CFBundleURLTypes; a QFileOpenEvent filter is installed on QApplication
  before any nested event loop so cold-start URLs aren't lost.

New abstractions
- Intent (libcockatrice_utility/libcockatrice/utility/intent.h): abstract base
  for chained async actions.  Guarantees finished() fires at most once,
  execute() is idempotent, self-deletes via deleteLater, and
  startTimeoutSafetyNet() arms a configurable per-stage deadline.  Concrete
  intents (IntentConnectToServer, IntentLogin, IntentJoinServerRoom,
  IntentJoinServerGame) compose the joingame flow via UrlParser.
- SingleInstanceManager: async per-user local-socket primary/secondary
  handshake; URL forwarded from secondary to primary with QDataStream framing
  both ways.  shared_ptr-backed resolved flag survives every lambda capture.
- UrlSchemeEventFilter (new libcockatrice_utility_gui sibling library): QObject
  event filter that translates macOS QFileOpenEvent into a urlReceived(QString)
  signal.  Lives in its own Gui-bearing lib so libcockatrice_utility stays
  Core+Network only and doesn't drag Qt::Gui into servatrice.
- UrlUtils (header-only): pure URL parsing, fully unit-tested.

Wiring
- MainWindow::handleUrl(QString) — single entry point for any URL source.
- DlgConnect::prefillNewHost(host, port) — pre-fills new-host inputs.
- ServersSettings::findSavedCredsByHostPort — case-insensitive saved-creds
  lookup.
- TabSupervisor::requestJoinRoom + roomJoinedById / roomJoinFailedById signals,
  TabServer::roomAlreadyJoined for the short-circuit "already in this room"
  path — single source of truth for duplicate-join handling.

Tests
- 36 new unit tests across four single-purpose targets in tests/:
  - url_utils_test (22 tests) — scheme matching, port/room/game validation,
    spectator flag, credentials ignored, case-insensitivity.
  - url_scheme_event_filter_test (3 tests) — QFileOpenEvent capture.
  - intent_test (7 tests) — self-delete, abort propagation, parent-destruction-
    mid-flight, finish-once gate, execute() idempotence.
  - single_instance_manager_test (4 tests) — per-user socket naming, becoming-
    primary alone, forwarding to an existing primary, single-emission of
    roleResolved.

Build tooling (incidental)
- Dockerfile.format, docker-compose.format.yml, Makefile — a docker-based
  runner for format.sh that mirrors CI's desktop-lint step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

libcockatrice_utility/libcockatrice/utility/single_instance_manager.cpp

@@ -0,0 +1,145 @@
+#include "single_instance_manager.h"
+
+#include <QDataStream>
+#include <QLoggingCategory>
+#include <QTimer>
+#include <memory>
+
+Q_LOGGING_CATEGORY(SingleInstanceLog, "single_instance")
+
+SingleInstanceManager::SingleInstanceManager(const QString &socketName, QObject *parent)
+    : QObject(parent), socketName(socketName)
+{
+}
+
+SingleInstanceManager::~SingleInstanceManager() = default;
+
+QString SingleInstanceManager::perUserSocketName(const QString &base)
+{
+#ifdef Q_OS_WIN
+    const QByteArray user = qgetenv("USERNAME");
+#else
+    const QByteArray user = qgetenv("USER");
+#endif
+    if (user.isEmpty())
+        return base;
+    return base + QStringLiteral("-") + QString::fromLocal8Bit(user);
+}
+
+void SingleInstanceManager::becomePrimary()
+{
+    if (server)
+        return; // already listening — idempotent
+    QLocalServer::removeServer(socketName);
+    server = new QLocalServer(this);
+    if (!server->listen(socketName)) {
+        qCWarning(SingleInstanceLog) << "Failed to start local server:" << server->errorString();
+        return;
+    }
+    connect(server, &QLocalServer::newConnection, this, &SingleInstanceManager::onNewConnection);
+}
+
+void SingleInstanceManager::resolveStartupRole(const QString &maybeUrl)
+{
+    if (maybeUrl.isEmpty()) {
+        // No URL to forward — just try to become primary.  Defer the signal
+        // via a queued emission so the contract ("emits roleResolved exactly
+        // once, asynchronously") holds uniformly across both branches.
+        becomePrimary();
+        QMetaObject::invokeMethod(this, [this] { emit roleResolved(false); }, Qt::QueuedConnection);
+        return;
+    }
+
+    // Probe an existing primary.  Lifetime: probe and timer are owned by
+    // *this*; the terminal slot deleteLater()s them.  A shared "resolved"
+    // flag prevents double emission if multiple signals race (errorOccurred
+    // can fire after readyRead, etc.).  shared_ptr so the flag outlives
+    // whichever lambda fires last.
+    auto *probe = new QLocalSocket(this);
+    auto *timer = new QTimer(this);
+    auto resolved = std::make_shared<bool>(false);
+
+    auto finish = [this, probe, timer, resolved](bool forwarded) {
+        if (*resolved)
+            return;
+        *resolved = true;
+        timer->stop();
+        probe->deleteLater();
+        timer->deleteLater();
+        if (!forwarded)
+            becomePrimary();
+        emit roleResolved(forwarded);
+    };
+
+    connect(probe, &QLocalSocket::connected, this, [probe, maybeUrl] {
+        QDataStream stream(probe);
+        stream.setVersion(QDataStream::Qt_5_0);
+        stream << maybeUrl;
+        probe->flush();
+    });
+
+    connect(probe, &QLocalSocket::readyRead, this, [probe, finish] {
+        QDataStream in(probe);
+        in.setVersion(QDataStream::Qt_5_0);
+        in.startTransaction();
+        QString ack;
+        in >> ack;
+        if (!in.commitTransaction())
+            return; // partial ACK — wait for readyRead to fire again with the rest.
+        finish(true);
+    });
+
+    connect(probe, &QLocalSocket::errorOccurred, this, [finish](QLocalSocket::LocalSocketError) {
+        // No primary at this socket — become primary ourselves.
+        finish(false);
+    });
+
+    timer->setSingleShot(true);
+    connect(timer, &QTimer::timeout, this, [finish] {
+        // Primary unresponsive (e.g. stale socket from a dead old primary).
+        // Become primary and hope for the best.
+        qCWarning(SingleInstanceLog) << "Timed out forwarding URL; becoming primary";
+        finish(false);
+    });
+    timer->start(ForwardTimeoutMs);
+
+    probe->connectToServer(socketName);
+}
+
+void SingleInstanceManager::onNewConnection()
+{
+    while (server->hasPendingConnections()) {
+        QLocalSocket *socket = server->nextPendingConnection();
+        connect(socket, &QLocalSocket::readyRead, this, [this, socket]() { processConnection(socket); });
+        connect(socket, &QLocalSocket::disconnected, socket, &QLocalSocket::deleteLater);
+
+        // The secondary may have written its URL and the bytes may have
+        // arrived before we got here.  readyRead has already fired once for
+        // them with no slot connected — drain pre-buffered bytes now so the
+        // payload doesn't sit unread forever.
+        if (socket->bytesAvailable() > 0)
+            processConnection(socket);
+    }
+}
+
+void SingleInstanceManager::processConnection(QLocalSocket *socket)
+{
+    QDataStream in(socket);
+    in.setVersion(QDataStream::Qt_5_0);
+    in.startTransaction();
+    QString url;
+    in >> url;
+    if (!in.commitTransaction())
+        return; // partial payload — readyRead will fire again
+
+    if (!url.isEmpty()) {
+        qCDebug(SingleInstanceLog) << "Received URL from secondary instance:" << url;
+        emit urlReceived(url);
+    }
+
+    // Acknowledge so the secondary can finish cleanly.
+    QDataStream out(socket);
+    out.setVersion(QDataStream::Qt_5_0);
+    out << QStringLiteral("ACK");
+    socket->flush();
+}