polish(desktop): normalize cloud-URL highlight match + correct signedIn doc

Cleanups on top of @ben's Hermes Cloud salvage:
- isConnectedAgent normalized both sides of the cloud-URL comparison (trim +
  drop trailing slash + lowercase). The saved URL is host-lowercased by
  normalizeRemoteBaseUrl but the discovered dashboardUrl is raw from NAS, so
  a host-casing difference could silently break the connected-highlight.
- DesktopCloudStatus.signedIn doc said "AT-or-RT"; it actually reflects the
  Nous portal Privy session (privy-token), not the gateway cookies.

apps/desktop/src/app/settings/gateway-settings.tsx

@@ -199,12 +199,16 @@ export function GatewaySettings() {
   // cloud connection's remoteUrl), normalized for comparison against each
   // discovered agent's dashboardUrl so we can highlight the active one and hide
   // its Connect button. Empty unless the saved connection is a cloud one.
-  const connectedCloudUrl = state.mode === 'cloud' ? state.remoteUrl.trim().replace(/\/+$/, '') : ''
+  // The saved cloud URL was stored via the main-side normalizeRemoteBaseUrl
+  // (which lowercases the host through URL.toString()), but a discovered agent's
+  // dashboardUrl arrives raw from NAS — so normalize both sides the same way
+  // (trim, drop trailing slash, lowercase) or a host-casing difference would
+  // silently break the connected-highlight.
+  const normalizeCloudUrl = (url: string) => url.trim().replace(/\/+$/, '').toLowerCase()
+  const connectedCloudUrl = state.mode === 'cloud' ? normalizeCloudUrl(state.remoteUrl) : ''
 
   const isConnectedAgent = (agent: DesktopCloudAgent) =>
-    Boolean(
-      connectedCloudUrl && agent.dashboardUrl && agent.dashboardUrl.trim().replace(/\/+$/, '') === connectedCloudUrl
-    )
+    Boolean(connectedCloudUrl && agent.dashboardUrl && normalizeCloudUrl(agent.dashboardUrl) === connectedCloudUrl)
 
   useEffect(() => {
     if (state.mode !== 'remote' || !trimmedUrl || !/^https?:\/\//i.test(trimmedUrl)) {

apps/desktop/src/global.d.ts

@@ -477,7 +477,9 @@ export interface DesktopOauthLogoutResult {
 export interface DesktopCloudStatus {
   // The portal base URL the desktop talks to (default or env-overridden).
   portalBaseUrl: string
-  // Whether the OAuth partition holds a live portal session (AT-or-RT).
+  // Whether the OAuth partition holds a live Nous portal (Privy) session — the
+  // portal authenticates via Privy, so this reflects the privy-token cookie, NOT
+  // the hermes gateway session cookies. See cookiesHavePrivySession.
   signedIn: boolean
 }