fix(desktop): update nostr-relay-pool for RUSTSEC-2026-0224

## Summary

`desktop/src-tauri/Cargo.lock` still resolves `nostr-relay-pool` to `0.44.1`, which is affected by [RUSTSEC-2026-0224](https://rustsec.org/advisories/RUSTSEC-2026-0224). PR #4139 corrected the root lockfile, but the independent desktop lockfile remains unchanged on current `main` and in `desktop-v0.5.3`.

## Reproduction

At `main` commit `28ae6cd2174309529305724e455c7ca082f6fe4b`:

```bash
rg -n -A3 '^name = "nostr-relay-pool"' desktop/src-tauri/Cargo.lock
```

reports:

```text
name = "nostr-relay-pool"
version = "0.44.1"
```

The desktop graph can be checked explicitly with the repository-pinned toolchain:

```bash
. ./bin/activate-hermit
cargo-deny \
--manifest-path desktop/src-tauri/Cargo.toml \
--target aarch64-apple-darwin \
--exclude-dev \
check --config deny.toml advisories
```

The existing Security job runs `cargo-deny check` only from the repository root, so it does not enforce the independent desktop lockfile.

## Proposed solution

1. Update `nostr-relay-pool` in `desktop/src-tauri/Cargo.lock` to the patched `0.44.2` release.
2. Add a target-specific desktop advisory check to CI so future releases cannot diverge silently from the root lockfile.
3. Configure cargo-deny to fail on directly used unmaintained crates while keeping transitive no-fix notices visible (`unmaintained = "workspace"`); vulnerability advisories remain fatal.

I can submit the narrow lockfile and CI change if this approach is acceptable.

Start with desktop/src-tauri/Cargo.lock, desktop/src-tauri/Cargo.toml, and deny.toml, then inspect the existing root Security job and run the repository-pinned cargo-deny command from the issue. Done means the desktop lockfile resolves nostr-relay-pool to 0.44.2, the target-specific advisory check covers the desktop manifest, and the requested unmaintained-crate policy is configured without weakening vulnerability failures.

Written by the indexing model from the issue text.