docs: update README with desktop requirements, helper builds, and realistic MVP usage notes

Expand README with desktop platform requirements (Windows x86, macOS ARM), helper build commands, gateway utility scripts, and updated local test flow. Add realistic MVP usage section clarifying current platform build status, gateway configuration needs, and admin debug profile behavior with client private key handling.

desktop-client/scripts/build-tunnel-helper.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -eu
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+HELPER_DIR="${ROOT_DIR}/tunnel-helper"
+BUNDLED_DIR="${ROOT_DIR}/src-tauri/bundled"
+
+TARGET="${1:-}"
+if [ -z "${TARGET}" ]; then
+  echo "usage: build-tunnel-helper.sh <cargo-target>"
+  exit 1
+fi
+
+case "${TARGET}" in
+  i686-pc-windows-msvc)
+    OUTPUT_DIR="${BUNDLED_DIR}/windows-x86"
+    OUTPUT_NAME="nexavpn-tunnel-helper.exe"
+    ;;
+  aarch64-apple-darwin)
+    OUTPUT_DIR="${BUNDLED_DIR}/macos-arm64"
+    OUTPUT_NAME="nexavpn-tunnel-helper"
+    ;;
+  *)
+    echo "unsupported target: ${TARGET}"
+    exit 1
+    ;;
+esac
+
+mkdir -p "${OUTPUT_DIR}"
+cargo build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}"
+cp "${HELPER_DIR}/target/${TARGET}/release/${OUTPUT_NAME}" "${OUTPUT_DIR}/${OUTPUT_NAME}"
+echo "Bundled ${OUTPUT_NAME} into ${OUTPUT_DIR}"