feat: register cockatrice:// and cockatrice-oracle:// protocol handlers

Adds OS-level URL-scheme handlers so users can click a link in a browser,
chat client, or third-party tool to launch Cockatrice straight into a
server / game / Oracle update.

Supported URL forms:
  cockatrice://joingame?hostname=H&port=P&roomid=R&gameid=G[&spectate=1]
  cockatrice-oracle://update[?spoilers=1]

Credentials passed via URL (username/password query params) are deliberately
ignored — URLs leak through shell history, browser history, EDR capture, etc.
If the target server requires auth and no saved credentials match, the Connect
dialog opens pre-filled with the URL's host/port so the user types their
password locally.

OS integration
- Linux: MimeType=x-scheme-handler/cockatrice (and -oracle) added to the
  .desktop files; Exec=cockatrice %u passes the URL through.
- Windows: NSIS installer writes HKCR\cockatrice and HKCR\cockatrice-oracle
  registry entries; uninstaller removes them.
- macOS: per-app Info.cockatrice.plist / Info.oracle.plist declare
  CFBundleURLTypes; a QFileOpenEvent filter is installed on QApplication
  before any nested event loop so cold-start URLs aren't lost.

New abstractions
- Intent (libcockatrice_utility/libcockatrice/utility/intent.h): abstract base
  for chained async actions.  Guarantees finished() fires at most once,
  execute() is idempotent, self-deletes via deleteLater, and
  startTimeoutSafetyNet() arms a configurable per-stage deadline.  Concrete
  intents (IntentConnectToServer, IntentLogin, IntentJoinServerRoom,
  IntentJoinServerGame) compose the joingame flow via UrlParser.
- SingleInstanceManager: async per-user local-socket primary/secondary
  handshake; URL forwarded from secondary to primary with QDataStream framing
  both ways.  shared_ptr-backed resolved flag survives every lambda capture.
- UrlSchemeEventFilter (new libcockatrice_utility_gui sibling library): QObject
  event filter that translates macOS QFileOpenEvent into a urlReceived(QString)
  signal.  Lives in its own Gui-bearing lib so libcockatrice_utility stays
  Core+Network only and doesn't drag Qt::Gui into servatrice.
- UrlUtils (header-only): pure URL parsing, fully unit-tested.

Wiring
- MainWindow::handleUrl(QString) — single entry point for any URL source.
- DlgConnect::prefillNewHost(host, port) — pre-fills new-host inputs.
- ServersSettings::findSavedCredsByHostPort — case-insensitive saved-creds
  lookup.
- TabSupervisor::requestJoinRoom + roomJoinedById / roomJoinFailedById signals,
  TabServer::roomAlreadyJoined for the short-circuit "already in this room"
  path — single source of truth for duplicate-join handling.

Tests
- 36 new unit tests across four single-purpose targets in tests/:
  - url_utils_test (22 tests) — scheme matching, port/room/game validation,
    spectator flag, credentials ignored, case-insensitivity.
  - url_scheme_event_filter_test (3 tests) — QFileOpenEvent capture.
  - intent_test (7 tests) — self-delete, abort propagation, parent-destruction-
    mid-flight, finish-once gate, execute() idempotence.
  - single_instance_manager_test (4 tests) — per-user socket naming, becoming-
    primary alone, forwarding to an existing primary, single-emission of
    roleResolved.

Build tooling (incidental)
- Dockerfile.format, docker-compose.format.yml, Makefile — a docker-based
  runner for format.sh that mirrors CI's desktop-lint step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

libcockatrice_utility/libcockatrice/utility/single_instance_manager.h

@@ -0,0 +1,97 @@
+#ifndef LIBCOCKATRICE_SINGLE_INSTANCE_MANAGER_H
+#define LIBCOCKATRICE_SINGLE_INSTANCE_MANAGER_H
+
+#include <QLocalServer>
+#include <QLocalSocket>
+#include <QObject>
+#include <QString>
+
+/**
+ * @brief Local-socket-based single-instance guard with URL forwarding.
+ *
+ * Asynchronously resolves whether this process is the primary instance or a
+ * secondary that should forward a URL and exit.  All transitions are
+ * driven by Qt signals (QLocalSocket::connected / readyRead /
+ * errorOccurred) plus a single timeout — no synchronous waitFor* calls
+ * anywhere, so platform-specific event-pump quirks don't race.
+ *
+ * Usage at startup (typically in main(), before QApplication::exec()):
+ *
+ * @code
+ *   SingleInstanceManager sim(SingleInstanceManager::perUserSocketName("MyApp"));
+ *   QEventLoop startupLoop;
+ *   bool wasForwarded = false;
+ *   QObject::connect(&sim, &SingleInstanceManager::roleResolved,
+ *                    [&](bool forwarded) {
+ *       wasForwarded = forwarded;
+ *       startupLoop.quit();
+ *   });
+ *   sim.resolveStartupRole(urlFromArgv);  // may be empty
+ *   startupLoop.exec();
+ *   if (wasForwarded) return 0;
+ *   // ...continue as primary (or as a non-primary secondary if no URL)...
+ *   QObject::connect(&sim, &SingleInstanceManager::urlReceived,
+ *                    &mainWindow, &MainWindow::handleUrl);
+ * @endcode
+ */
+class SingleInstanceManager : public QObject
+{
+    Q_OBJECT
+
+public:
+    /** Deadline for the probe-and-forward handshake.  After this, we assume
+     *  no primary is listening (or the old primary is dead) and become
+     *  primary ourselves. */
+    static constexpr int ForwardTimeoutMs = 2000;
+
+    explicit SingleInstanceManager(const QString &socketName, QObject *parent = nullptr);
+    ~SingleInstanceManager() override;
+
+    /**
+     * @brief Build a per-user socket name to prevent cross-user squatting.
+     *
+     * Appends the current user's name from $USER (Unix) or $USERNAME (Windows)
+     * to @p base, separated by a dash.  Falls back to @p base unchanged when
+     * the env var is empty.
+     */
+    static QString perUserSocketName(const QString &base);
+
+    /**
+     * @brief Asynchronously resolve our startup role.
+     *
+     * - If @p maybeUrl is non-empty AND a primary instance is already
+     *   running, forward the URL to it and emit @c roleResolved(true).
+     * - Otherwise (no URL, OR no primary, OR primary unresponsive within
+     *   @c ForwardTimeoutMs), become the primary instance and emit
+     *   @c roleResolved(false).
+     *
+     * Emits @c roleResolved exactly once.  Intended to be called at most
+     * once at process startup, before @c QApplication::exec().
+     */
+    void resolveStartupRole(const QString &maybeUrl);
+
+signals:
+    /** Emitted exactly once after resolveStartupRole completes.
+     *  @param forwarded true if a primary existed and we sent the URL to it
+     *                   (caller should exit); false if we are now primary. */
+    void roleResolved(bool forwarded);
+
+    /** Emitted on the primary instance whenever another instance sends a URL. */
+    void urlReceived(const QString &url);
+
+private slots:
+    void onNewConnection();
+
+private:
+    QString socketName;
+    QLocalServer *server{nullptr};
+
+    /** Listen on @c socketName.  Idempotent — safe to call once we've been
+     *  resolved as the primary. */
+    void becomePrimary();
+
+    /** Read the URL from @p socket and emit @c urlReceived, then ACK. */
+    void processConnection(QLocalSocket *socket);
+};
+
+#endif // LIBCOCKATRICE_SINGLE_INSTANCE_MANAGER_H