fix(pairing): backport upstream mobile pairing and tailscale endpoint fixes

[enisze]

Our fork is 653 commits behind pingdotgg/t3code (152 ahead). While chasing a phone that couldn't pair with the desktop, I checked what upstream already fixed in this area and found four commits we simply never picked up. This backports them rather than reinventing them — a full 653-commit merge conflicts in 86 files / 300 hunks (including Migrations.ts, the orchestration decider, and ChatView.tsx at 45 hunks alone), so that stays a separate job.

Backported (cherry-picked with -x, original authors preserved)

Upstream	What it fixes
pingdotgg#4990 fix(mobile): default bare IP pairing to HTTP	Typing 192.168.1.21:3773 built an https URL against a plain-HTTP desktop, so the handshake failed and reported an opaque transport error
pingdotgg#7086 fix(mobile): stop a directly-saved backend from hiding its T3 Connect environment	A directly-saved backend masked the same machine's T3 Connect entry
pingdotgg#6487 fix(mobile): recover the QR pairing scanner when camera access is denied	Permanently-denied camera left the scanner dead with no route to Settings
pingdotgg#7116 fix(desktop): keep tailscale spawn defects from breaking advertised endpoints	A tailscale spawn defect took down the whole advertised-endpoint list — which matters here, since Tailscale is the answer for pairing from cellular

(Numbers refer to upstream pingdotgg/t3code PRs; each commit keeps its cherry picked from trailer.)

One conflict, in ConnectionsNewRouteScreen.tsx: upstream's hunk also imported useRef for a commit we haven't taken. Resolved by keeping our hook set and taking only Linking, which pingdotgg#6487 actually needs.

Also included: a one-line fixture fix (sidebarV2GroupByProject missing from DesktopClientSettings.test.ts). That test was already failing on main and typecheck already flagged the object as incomplete — unrelated to the backports, but the suite had to be green to verify them.

Verification

• apps/mobile 556, apps/desktop 406 (was 405 + 1 pre-existing failure), packages/tailscale 14, packages/shared 323 — all pass.
• Lint and format clean across the touched paths; desktop typecheck reports no errors.
• Two pre-existing mobile typecheck errors remain in Stack.tsx and archivedThreadList.test.ts. Both files are untouched by this branch — confirmed against the diff — so they predate it and are out of scope here.
• arm64 DMG built from this branch.

Relationship to the open PRs

#68 independently reimplemented upstream pingdotgg#4990's scheme fix before I knew upstream had it. Upstream's version is canonical, so #68 should be trimmed to just its transport-error hint (which upstream lacks) and #69 rebased on top.

What this does not fix

Not the original report. The desktop serves http://192.168.1.21:3773 correctly, the firewall is off, Android cleartext HTTP is already enabled by withAndroidCleartextTraffic.cjs, iOS declares NSLocalNetworkUsageDescription — and with the correct address entered, no connection from the phone reaches this machine. That points at the network path between phone and Mac, not at app code.

🤖 Generated with Claude Code