fix(desktop): bundle version-major shipping RPC handlers

[yzxcj797]

Summary

• Extend sidecar handler discovery to both api/{domain}/v{major}/[rpc].ts and api/v{major}/{domain}/[rpc].ts.
• Bundle the Shipping v2 RPC gateway into the desktop sidecar while leaving non-RPC webhook routes untouched.
• Add discovery regressions, include them in the sidecar suite, and make CI verify a bundle for every discovered RPC entry point.

Fixes #5907

Testing

• Before: node scripts/build-sidecar-handlers.mjs reported 34 domains and emitted no api/v2/shipping/[rpc].js; the new regression failed.
• After: the build reports 35 handlers and emits the Shipping v2 bundle.
• node --test tests/build-sidecar-handlers.test.mjs — 2 passed.
• npm run test:sidecar — 395 passed.
• npx tsx --test tests/shipping-v2-handler.test.mjs — 29 passed (existing auth, tenant-isolation, SSRF, and secret-redaction coverage).
• npm run typecheck:all — passed.
• npm run lint — passed (repository-wide warnings are pre-existing); targeted Biome check on changed script/test files passed.
• npm run lint:api-contract and npm run lint:boundaries — passed.
• npm run security:local-env-dumps and npm run security:vite-env-secrets — passed.
• git diff --check — passed.

Security review

• Discovery is static and repository-local: it reads only committed [rpc].ts paths, performs no network requests, evaluates no external input, and does not introduce dynamic module loading.
• Non-RPC webhook routes remain outside this bundle, so their routing behavior is unchanged.
• No credentials, telemetry, logging, privacy data, or authentication logic are added. Existing Shipping v2 authorization and sidecar authentication tests continue to pass.

[vercel]

@yzxcj797 is attempting to deploy a commit to the World Monitor Team on Vercel.

A member of the Team first needs to authorize it.