chore(hardening): tighten security and footprint defaults

src-tauri/capabilities/main.json

@@ -1,8 +1,8 @@
 {
   "$schema": "../gen/schemas/desktop-schema.json",
-  "identifier": "default",
-  "description": "Capability for the main window",
-  "windows": ["main", "tasks-float", "transcript-viewer", "transcription-preview"],
+  "identifier": "main",
+  "description": "Main window capability for user-initiated app control.",
+  "windows": ["main"],
   "permissions": [
     "core:default",
     "core:window:allow-start-dragging",

src-tauri/capabilities/secondary-windows.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "secondary-windows",
+  "description": "Narrow capability for passive secondary windows.",
+  "windows": ["tasks-float", "transcript-viewer", "transcription-preview"],
+  "permissions": [
+    "core:event:default",
+    "core:window:allow-start-dragging",
+    "core:window:allow-close",
+    "core:window:allow-hide",
+    "core:window:allow-show",
+    "core:window:allow-set-focus"
+  ]
+}