Scope desktop backend TLS pins to individual connections

**What problem would this solve?**

The desktop app can keep multiple external backend connections alive at once, including connections to the same hostname with different certificate pins. Certificate verification is installed on shared Electron sessions, so the product needs an explicit rule for which connection-specific pin authorizes each request.

**What would a good outcome look like?**

Every authenticated backend request is verified against the pin and origin for its own connection lease. Existing windows can remain connected when supported, without one active lease broadening trust for another.

**Possible approaches**

- Give each backend lease an isolated transport or Electron session with its own verifier.
- Bind verification state to an unambiguous request or connection identity rather than hostname alone.
- Deliberately retire older same-host leases when a new pin is configured, if maintainers prefer simpler newest-connection semantics.

The design should settle same-origin certificate rotation, port scoping, window lifetime, and compatibility with concurrent external backends.

**Additional context**

- [x] I have verified this does not duplicate an existing feature request

Do not begin implementation until the issue reaches **Ready** on the [Goose Issues board](https://github.com/orgs/aaif-goose/projects/1).

Look at the desktop app's backend connection management and certificate pinning logic. Identify where TLS verification is currently installed on shared Electron sessions. Examine how connection leases are created and tracked. Determine how to isolate verification state per lease, considering session isolation or request identity binding. Review existing tests for backend connectivity and TLS.

索引モデルが issue の本文から書いたものです。