config(desktop): disable_custom_urls here too, not only in the web deployment

Decision sorb. The desktop client loads this config.json rather than the one the web
deployment serves, so setting it in element-values.yaml alone would have hardened the
web client and left the builds that actually get handed out untouched - the same trap
as the themes rollout.

It hides the edit button next to the server name, so the homeserver cannot be changed
through the interface, and it makes the 401/403 login error name the server instead of
staying generic.

Stated in the comment rather than discovered later: this is a surface restriction, not
a technical one. MatrixChat still accepts hs_url from the query string in the mobile
registration and registration-confirmation paths without consulting the setting. It
narrows the way to GHSA-wrcp-5v3v-3j6v, which affects everything below 1.12.22 while
we run 1.12.17, and it does not replace the upstream update that management #0099 is
actually about.

Takes effect with the next desktop build.

apps/desktop/axion1337/config.json

@@ -1,5 +1,7 @@
 {
   "brand": "aXion1337.Chat",
+  "_kommentar_custom_urls": "Entscheidung sorb 2026-08-19 (management #0099). Muss hier SEPARAT stehen: der Desktop-Client laedt diese config.json, nicht die des Web-Deployments - derselbe Fallstrick wie beim Themes-Rollout. Blendet den Bearbeiten-Knopf am Servernamen aus; der hs_url-Query-Parameter bleibt davon unberuehrt. Verengt die Flaeche fuer GHSA-wrcp-5v3v-3j6v, ersetzt das Upstream-Update nicht.",
+  "disable_custom_urls": true,
   "bug_report_endpoint_url": "local",
   "branding": {
     "auth_header_logo_url": "vector-icons/512.png",