fix(process): harden Node.js path discovery for production readiness

- Fix thread safety: replace #[tokio::main] in codeg_server with manual
  runtime construction so set_var runs before any worker threads exist
- Fix nvm alias branch: sort matched candidates (read_dir order is
  undefined) and skip non-numeric aliases like lts/* that cannot be
  resolved without full nvm evaluation
- Fix HOME missing: accept Option<&Path> for home so env-var-only
  discovery (NVM_HOME, VOLTA_HOME, FNM_DIR, etc.) still works in
  Docker / systemd environments without HOME set
- Refactor resolve_dir to accept an env var chain, eliminating all
  inline Option chains for fnm, nvm-windows, mise, and scoop

src-tauri/src/bin/codeg_server.rs

@@ -7,8 +7,7 @@ use codeg_lib::web::{
     find_static_dir_standalone, generate_random_token, get_local_addresses, WebServerState,
 };
 
-#[tokio::main]
-async fn main() {
+fn main() {
     // Support --version flag
     let args: Vec<String> = std::env::args().collect();
     if args.iter().any(|a| a == "--version" || a == "-V") {
@@ -16,9 +15,20 @@ async fn main() {
         return;
     }
 
+    // PATH initialisation MUST happen before the tokio runtime is created.
+    // std::env::set_var is not thread-safe (unsafe in Rust edition 2024);
+    // #[tokio::main] would spawn worker threads before we reach this point.
     codeg_lib::process::ensure_node_in_path();
     codeg_lib::process::ensure_user_npm_prefix_in_path();
 
+    tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+        .expect("Failed to build tokio runtime")
+        .block_on(async_main());
+}
+
+async fn async_main() {
     let port: u16 = std::env::var("CODEG_PORT")
         .ok()
         .and_then(|v| v.parse().ok())