fix(desktop): inline prototype-pollution guard so CodeQL sees it

CodeQL's dataflow doesn't follow the helper-function guard inside
`safeSet`, so it kept flagging Object.defineProperty as prototype-
polluting. Inline the literal `__proto__`/`constructor`/`prototype`
check at the assignment site to break the dataflow.

Behavior unchanged — same set of disallowed keys, same throw.

apps/desktop/src/app/settings/helpers.ts

@@ -40,7 +40,7 @@ function configPathParts(path: string): string[] {
 }
 
 function safeSet(target: Record<string, unknown>, key: string, value: unknown): void {
-  if (!isSafePart(key)) {
+  if (key === '__proto__' || key === 'constructor' || key === 'prototype' || !key) {
     throw new Error(`Unsafe config key: ${key}`)
   }
   Object.defineProperty(target, key, {