Desktop built-in browser can't grant standing permissions for .local hosts (WordPress Studio sites)

## Summary

In the Claude desktop app, every browser action on a local site `https://site.local` (a WordPress Studio site served from 127.0.0.1) prompts with:

> Site-level permissions are disabled for this site. You'll be asked for each action.

Adding the site to **Allowed sites** doesn't help. The site is present in `launchPreviewAllowedOrigins` in `claude_desktop_config.json`, and navigation works, but every click, type, and screenshot still prompts. The "Always allow reads on this host" option is never offered.

## Cause

The desktop app's private-host resolver in `app.asar` returns `not-private` when the hostname is `local`, ends with `.local`, or has no dot (`localhost`). That path forces `_perActionOnly` on every request and never sets `_privateHostReadAlwaysOffer`, so `.local` hosts can't receive a standing grant even though they resolve to loopback.

WordPress Studio requires custom site domains to end in `.local` (its bundle enforces "The domain name must end with .local"), so no domain satisfies both tools. Studio's default `localhost:` is dotless and hits the same exclusion.

## Expected

A `.local` or `localhost` host that resolves to loopback or a private address should be eligible for the same "Always allow reads on this host" grant as a dotted private hostname, or Allowed sites should suppress the per-action card for it.

## Steps to reproduce

1. Create a WordPress Studio site and give it a custom domain (Studio only allows `.local`).
2. In the desktop app, start a Claude Code session and have it open the site in the built-in browser pane.
3. Ask it to take a screenshot or click anything.
4. Observe that every action prompts and no standing grant is offered. Adding the site to Allowed sites doesn't change this.

## Environment

- macOS (Darwin 27.0.0)
- Claude desktop app, bundled Claude Code 2.1.271
- WordPress Studio with a `.local` custom domain and HTTPS enabled (Studio CA trusted in the login keychain; the site loads fine in Chrome and curl)

Start by locating the private-host resolver in the desktop app's bundled app.asar and reproduce the behavior with a WordPress Studio .local site or localhost. Done means loopback or private .local and dotless hosts can receive the standing read grant, or Allowed sites suppresses repeated per-action prompts.

Written by the indexing model from the issue text.