fix(installer): bundle cryptography + just-playback, set TCL env, clean stale debug.bat

Windows installer silently failed to launch because build-dist-windows.sh
maintained its own DEPS list that drifted from server/pyproject.toml and
was missing `cryptography` — ledgrab.utils.secret_box imports AESGCM at
module load, so pythonw.exe crashed before the tray icon appeared. Also
missing: just-playback (lazy import, silent until a sound triggers).

- Add cryptography + just-playback to DEPS with a sync-with-pyproject
  warning comment
- Extend the post-cleanup on-disk check to abort the build if
  cryptography / cffi / just_playback go missing again
- Launcher now exports TCL_LIBRARY / TK_LIBRARY so the screen-overlay
  tkinter thread stops logging "Can't find init.tcl" at startup
- Installer wipes stale debug.bat / debug.log on install and uninstall
  (leftovers from the pre-rename wled_controller era produced a
  misleading ModuleNotFoundError when users tried to diagnose launch
  failures)

build/build-dist-windows.sh

@@ -178,10 +178,16 @@ echo "[6/9] Downloading Windows dependencies..."
 WHEEL_DIR="$BUILD_DIR/win-wheels"
 mkdir -p "$WHEEL_DIR"
 
-# Core dependencies (cross-platform, should have win_amd64 wheels)
+# Core dependencies (cross-platform, should have win_amd64 wheels).
+# KEEP IN SYNC with server/pyproject.toml [project.dependencies] — this
+# list duplicates it because cross-build on Linux can't invoke `pip install
+# <path>` against pyproject.toml with a Windows target. Missing entries
+# ship a broken installer that silently fails under pythonw.exe (no
+# traceback visible to the user). Audit after every pyproject.toml edit.
 DEPS=(
     "fastapi>=0.115.0"
     "uvicorn[standard]>=0.32.0"
+    "cryptography>=42.0.0"
     "httpx>=0.27.2"
     "mss>=9.0.2"
     "numpy>=2.1.3"
@@ -201,6 +207,7 @@ DEPS=(
     "aiomqtt>=2.0.0"
     "openrgb-python>=0.2.15"
     "opencv-python-headless>=4.8.0"
+    "just-playback>=0.1.7"
 )
 
 # Windows-only deps
@@ -291,9 +298,10 @@ compile_and_strip_sources "$SITE_PACKAGES" "python"
 echo "  Verifying required submodules exist after cleanup..."
 for required in \
     "numpy/linalg" "numpy/lib" "numpy/matrixlib" "numpy/ma" \
-    "zeroconf/_services"; do
+    "zeroconf/_services" \
+    "cryptography" "cffi" "just_playback"; do
     if [ ! -d "$SITE_PACKAGES/$required" ] && [ ! -f "$SITE_PACKAGES/$required.py" ] && [ ! -f "$SITE_PACKAGES/$required.pyc" ]; then
-        echo "  ERROR: $required missing from site-packages — cleanup_site_packages removed something required. Aborting."
+        echo "  ERROR: $required missing from site-packages — either cleanup_site_packages removed something required, or DEPS is out of sync with pyproject.toml. Aborting."
         exit 1
     fi
 done
@@ -328,6 +336,12 @@ cd /d "%~dp0"
 set PYTHONPATH=%~dp0app\src
 set LEDGRAB_CONFIG_PATH=%~dp0app\config\default_config.yaml
 
+:: Tcl/Tk ship under python\ but Tk's default search path is
+:: <python.exe>\..\lib\tcl8.6. Point it at the right location so
+:: the screen-overlay feature (tkinter) can start without errors.
+set TCL_LIBRARY=%~dp0python\tcl8.6
+set TK_LIBRARY=%~dp0python\tk8.6
+
 :: Create data directory if missing
 if not exist "%~dp0data" mkdir "%~dp0data"
 if not exist "%~dp0logs" mkdir "%~dp0logs"

build/build-dist.ps1

@@ -208,6 +208,12 @@ cd /d "%~dp0"
 set PYTHONPATH=%~dp0app\src
 set LEDGRAB_CONFIG_PATH=%~dp0app\config\default_config.yaml
 
+:: Tcl/Tk ship under python\ but Tk's default search path is
+:: <python.exe>\..\lib\tcl8.6. Point it at the right location so
+:: the screen-overlay feature (tkinter) can start without errors.
+set TCL_LIBRARY=%~dp0python\tcl8.6
+set TK_LIBRARY=%~dp0python\tk8.6
+
 :: Create data directory if missing
 if not exist "%~dp0data" mkdir "%~dp0data"
 if not exist "%~dp0logs" mkdir "%~dp0logs"

build/installer.nsi

@@ -98,6 +98,12 @@ Section "!${APPNAME} (required)" SecCore
   RMDir /r "$INSTDIR\app"
   RMDir /r "$INSTDIR\scripts"
   Delete "$INSTDIR\LedGrab.bat"
+  ; Legacy leftovers from the wled_controller-era install. The current
+  ; build does not ship debug.bat, but upgrades from older versions left
+  ; one behind with a stale `-m wled_controller` command that gives a
+  ; misleading ModuleNotFoundError when run. Remove it on upgrade.
+  Delete "$INSTDIR\debug.bat"
+  Delete "$INSTDIR\debug.log"
 
   ; Copy the entire portable build
   File /r "LedGrab\python"
@@ -187,6 +193,8 @@ Section "Uninstall"
   RMDir /r "$INSTDIR\app"
   RMDir /r "$INSTDIR\scripts"
   Delete "$INSTDIR\LedGrab.bat"
+  Delete "$INSTDIR\debug.bat"
+  Delete "$INSTDIR\debug.log"
   Delete "$INSTDIR\uninstall.exe"
 
   ; Remove logs (but keep data/)