feat(installer): scaffold Windows installer build pipeline

Lays down the Inno Setup + embedded Python pipeline for producing a
  self-contained Bambuddy Windows installer .exe. The installer ships
  an embedded Python 3.13, the pre-built React bundle, NSSM (service
  supervisor) and ffmpeg — no host Python or Node required on the
  target machine.

  Architecture:
  - Install: C:\Program Files\Bambuddy (admin install, one-time UAC)
  - Data:    C:\ProgramData\Bambuddy\data (preserved on uninstall)
  - Service: registered via NSSM, runs as LocalSystem, autostart on boot
  - UI:      browser at http://localhost:8000 (Start Menu shortcut)

  Files:
  - installers/windows/build.py            stages embedded Python + deps,
                                           frontend bundle, NSSM, ffmpeg
  - installers/windows/bambuddy.iss        Inno Setup compiler script
  - installers/windows/service/*.bat       NSSM register/deregister
  - .github/workflows/windows-installer.yml CI build on tag push + manual
                                           dispatch, uploads .exe artifact

  build.py hard-fails on non-Windows hosts; Wine cross-build is an
  unsupported escape hatch behind --allow-non-windows. v1 ships unsigned
  (SmartScreen warns on first run) — production signing will be wired up
  via SignPath OSS once the application is approved.

  See installers/windows/README.md for build prerequisites and the
  embedded-Python ._pth gotchas.

.github/workflows/windows-installer.yml

@@ -0,0 +1,66 @@
+name: Windows Installer
+
+# Build the Windows installer .exe.
+#
+# Triggers:
+#   - Tag push matching v* (release builds, uploaded as a release asset)
+#   - Manual dispatch (for testing the build pipeline)
+#
+# The installer is unsigned until SignPath OSS approval lands. Once it
+# does, add the SignPath GitHub Action between the ISCC step and the
+# upload step.
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: windows-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install Inno Setup
+        run: |
+          choco install innosetup --version=6.2.2 --no-progress -y
+        shell: pwsh
+
+      - name: Stage installer artifacts
+        working-directory: installers/windows
+        run: python build.py
+        shell: pwsh
+
+      - name: Compile installer (ISCC)
+        working-directory: installers/windows
+        run: |
+          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" bambuddy.iss
+        shell: pwsh
+
+      - name: Upload installer artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bambuddy-windows-installer
+          path: installers/windows/build/output/*.exe
+          if-no-files-found: error
+
+      - name: Attach installer to release
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: installers/windows/build/output/*.exe
+          fail_on_unmatched_files: true