docs(claude-apps-gateway): document the Claude Desktop overlay + the parent-settings opt-in

[bluedoors]

What

Anthropic added official Claude Desktop support to the apps gateway. This documents it. Two
separate mechanisms were previously missing or wrong here — one of them (2) is a silent
correctness bug for anyone who followed the existing snippets.

1. Desktop as a gateway client. The client half is bootstrapUrl →
<public_url>/user/bootstrap in Desktop's own managed configuration — a different key from
the CLI's forceLoginGatewayUrl. The server half is an explicit opt-in: /user/bootstrap
returns 404 unless the matching policy carries a desktop key, so desktop: {} on the
match: {} base opts in everyone who inherits it. Requires gateway ≥ 2.1.203 (this example
pins 2.1.218).

2. Policy delivery to Desktop's embedded Claude Code sessions. All three
managed-settings.json snippets were missing parentSettingsBehavior: "merge". Claude Code
ignores parent settings on a machine with an admin-deployed managed source unless the winning
source sets it — and Desktop delivers gateway policy to the sessions it launches as parent
settings. Following the old snippet left those sessions unpoliced, with no warning. This
is the correctness fix in here.

The FAQ answer was also wrong ("configure the gateway URL in the desktop app's managed
settings") — it names the wrong key and omits the server-side opt-in.

Two traps found while validating against a live deployment

• banner: { text: … } renders nothing. Desktop's banner.enabled has no default and
  text only applies when it's truthy, so the doc-style example needed enabled: true.
• The desktop block is validated strictly and its key set is bounded by the pin — an
  unknown key fails boot and crash-loops the ECS task. Verified against 2.1.218–2.1.221: nine
  keys accepted, and chatTabEnabled is not among them, so a bootstrap-configured Desktop
  loses its Chat tab with no way to restore it. Filed upstream as
  anthropics/claude-code#83723 and
  noted in docs/upstream-watch.md with a probe recipe for future bumps.

Scope

Docs + config template only. /user/bootstrap is same-host/same-port, so the ALB needs no new
listener rule or target group and the CDK stack is unchanged. gateway.yaml.template and
gateway.yaml.example kept in sync.

Verification

Existing suites pass unchanged, no new tests (no code paths added):

• cd cdk && npm test — 17 passed
• ./test/stamp-config.test.sh — 9 passed
• ./test/setup-helpers.test.sh — 14 passed
• bash -n clean on all four cdk/scripts/*.sh
• yaml.safe_load clean on gateway.yaml.example

Capability 1 (bootstrapUrl → bootstrap config served, and the 404 when the opt-in is
missing) and both traps were confirmed against a live deployment; that's where the
chatTabEnabled gap and the banner.enabled behavior came from.

Rebased onto current main; no overlap with the au./jp. prefix fix in #270.

[bsnehanshu]

Approved: Desktop-overlay claims (bootstrapUrl//user/bootstrap opt-in, desktop: key set, audit event names, parentSettingsBehavior: "merge" precedence) verified verbatim against the live config reference — including the banner.enabled gap, which Anthropic's own doc example has too. Independently reproduced the chatTabEnabled rejection from anthropics/claude-code#83723 locally (schema rejects the key, passes once removed) — also confirmed on 2.1.207, below the issue's tested range. Ran all three claimed suites on this branch — cdk test 17/17, setup-helpers.test.sh 14/14, stamp-config.test.sh 9/9 — plus bash -n on all four scripts and YAML parse on gateway.yaml.example, all clean. Docs + config template only, no code paths added.