fix(installer): bundle cryptography + just-playback, set TCL env, clean stale debug.bat

Windows installer silently failed to launch because build-dist-windows.sh
maintained its own DEPS list that drifted from server/pyproject.toml and
was missing `cryptography` — ledgrab.utils.secret_box imports AESGCM at
module load, so pythonw.exe crashed before the tray icon appeared. Also
missing: just-playback (lazy import, silent until a sound triggers).

- Add cryptography + just-playback to DEPS with a sync-with-pyproject
  warning comment
- Extend the post-cleanup on-disk check to abort the build if
  cryptography / cffi / just_playback go missing again
- Launcher now exports TCL_LIBRARY / TK_LIBRARY so the screen-overlay
  tkinter thread stops logging "Can't find init.tcl" at startup
- Installer wipes stale debug.bat / debug.log on install and uninstall
  (leftovers from the pre-rename wled_controller era produced a
  misleading ModuleNotFoundError when users tried to diagnose launch
  failures)

build/installer.nsi

@@ -98,6 +98,12 @@ Section "!${APPNAME} (required)" SecCore
   RMDir /r "$INSTDIR\app"
   RMDir /r "$INSTDIR\scripts"
   Delete "$INSTDIR\LedGrab.bat"
+  ; Legacy leftovers from the wled_controller-era install. The current
+  ; build does not ship debug.bat, but upgrades from older versions left
+  ; one behind with a stale `-m wled_controller` command that gives a
+  ; misleading ModuleNotFoundError when run. Remove it on upgrade.
+  Delete "$INSTDIR\debug.bat"
+  Delete "$INSTDIR\debug.log"
 
   ; Copy the entire portable build
   File /r "LedGrab\python"
@@ -187,6 +193,8 @@ Section "Uninstall"
   RMDir /r "$INSTDIR\app"
   RMDir /r "$INSTDIR\scripts"
   Delete "$INSTDIR\LedGrab.bat"
+  Delete "$INSTDIR\debug.bat"
+  Delete "$INSTDIR\debug.log"
   Delete "$INSTDIR\uninstall.exe"
 
   ; Remove logs (but keep data/)