Setup instructions

Implement LookLoot Capture in this Electron desktop app.

Read the LookLoot setup docs first:
- docs/sdk/quickstart.md
- docs/sdk/configuration.md
- docs/sdk/security.md

Requirements:
- Use Node.js 22 or newer.
- Install the SDK in the Electron main-process package: pnpm add @lookloot/capture-sdk
- Use the LookLoot-registered app slug for this desktop app as appId.
- Prepare the OBS runtime during the app build: npx lookloot-capture-prepare-obs --out vendor/obs
- For packaged Windows builds, bundle the portable OBS runtime so resources/obs/bin/64bit/obs64.exe exists.
- For local smoke tests or custom packagers, pass obsPath or set LOOKLOOT_OBS_PATH to the portable OBS obs64.exe.
- Only apps that own a privileged helper lifecycle should pass elevatedCapturePipeName; otherwise omit it.

Backend token route:
- Keep LOOKLOOT_PARTNER_KEY only on the backend.
- Add an authenticated endpoint such as POST /api/lookloot/device-token.
- That endpoint should call https://www.lookloot.gg/api/partner/auth/token with Authorization: Bearer ${LOOKLOOT_PARTNER_KEY} and JSON { externalUserId, appId, appVersion, deviceName }.
- appId must be a LookLoot-registered active app slug for the partner account, not freeform metadata.
- Return only the short-lived token to the desktop app. Do not expose the partner key to browser or desktop code.

Electron main-process setup:
```ts
import { app } from "electron";
import { join } from "node:path";
import { LookLootCapture } from "@lookloot/capture-sdk";

const capture = new LookLootCapture({
  appId: "your-registered-app-slug",
  appVersion: app.getVersion(),
  dataDir: join(app.getPath("userData"), "lookloot"),
  deviceName: app.getName(),
  obsPath: process.env.LOOKLOOT_OBS_PATH,
  getDeviceToken: async ({ appId, appVersion, deviceName }) => {
    const response = await fetch("https://your-api.example.com/api/lookloot/device-token", {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ appId, appVersion, deviceName }),
    });

    if (!response.ok) throw new Error("LookLoot token request failed");
    const data = await response.json();
    return data.token;
  },
});

capture.on("state-change", (state) => {
  console.log("LookLoot capture state:", state);
});

await capture.init();
```

After initialization, the SDK starts recording automatically when it detects a game and stops when that game exits.
The SDK installs an Electron before-quit cleanup handler by default; custom shutdown flows should await capture.dispose().

Windows packaging:
- Bundle the portable OBS root as an Electron extraResource named obs.
- Verify the unpacked app contains resources/obs/bin/64bit/obs64.exe before shipping.
- Run capture.getRuntimeDiagnostics() in a packaged-app smoke test to verify OBS, FFmpeg, and helper assets.

Acceptance criteria:
- Capture initializes from the Electron main process.
- Recording starts automatically on game detection and finalizes on game exit.
- Device-token retrieval can refresh or retry without exposing LOOKLOOT_PARTNER_KEY.
- App shutdown gives capture.dispose() time to stop and finalize active sessions.
- Windows packaged builds include resources/obs/bin/64bit/obs64.exe or local/custom builds pass obsPath.
- Protected/admin game capture uses a host-managed elevatedCapturePipeName only when the host app provides one.
- Runtime diagnostics pass before release.