feat: highlight search matches and document the working UI

tools/desktop-capture/backend/README.md

@@ -0,0 +1,45 @@
+# Real-engine screenshot backend
+
+This independent software-test server serves the built desktop frontend and
+connects its explicit `?capture=1` adapter to the actual shared Rust engine.
+It is not the packaged desktop application or a production HTTP API.
+
+The dedicated corpus contains five generated documents, including a genuine
+two-page Supplier Agreement PDF, plus the licensed mountain-lake/night-pier
+photos from `fixtures/media/fixture.json` (image03/image05). Photo checksums and
+original license attribution are retained there. Tests verify actual PDF page-2
+retrieval and unchanged-file reuse. No screenshots/results/vectors are replayed.
+
+Build the frontend, then run this standalone Cargo crate with `--locked`:
+
+```powershell
+cargo run --manifest-path tools/desktop-capture/backend/Cargo.toml --locked -- `
+  --root .searchi/desktop-capture/corpus `
+  --db .searchi/desktop-capture/index.db `
+  --models .searchi/models/embeddinggemma2 `
+  --worker .searchi/runtime/cpu/Release/searchi-gemma-worker.exe `
+  --dist apps/desktop/dist `
+  --ffmpeg .searchi/media-runtime/bin/ffmpeg.exe `
+  --ffprobe .searchi/media-runtime/bin/ffprobe.exe
+```
+
+Indexing, real CPU model inference and prewarming finish before the server
+listens on `http://127.0.0.1:1431/?capture=1`. It forces CPU mode and one model
+thread. Runtime never downloads anything. Existing matching corpus files are
+not rewritten; incompatible files or database roots are rejected.
+
+`GET /capture-info` returns the explicit mode, readiness, a per-process token
+and actual worker information. `POST /capture-api/{command}` requires the exact
+loopback Host, same-origin Origin and `X-Searchi-Capture-Token`, with a 64 KiB
+body cap. Only desktop/status/stats, measured lexical/hybrid search and fixed
+indexed-photo preview commands exist. Indexing, file opening, settings and
+arbitrary filesystem access are not browser commands. Static assets are
+canonicalized beneath the supplied frontend build; media IDs are only `lake`
+and `pier`. There are no CORS allowances or remote bindings.
+
+The operator must supply an empty dedicated corpus root and database; the
+server must not be pointed at user documents. This intentionally small fixture
+demonstrates real behavior, not production-scale performance. Host/Origin/token,
+path containment, unrelated-file rejection, PDF extraction and fixture reuse
+have CPU tests. The browser runner records actual receipts and screenshot
+measurements separately.