feat(native): record encoding (#14188)

fix #13784 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Start/stop system or meeting recordings with Ogg/Opus artifacts and
native start/stop APIs; workspace backup recovery.

* **Refactor**
* Simplified recording lifecycle and UI flows; native runtime now
orchestrates recording/processing and reporting.

* **Bug Fixes**
* Stronger path validation, safer import/export dialogs, consistent
error handling/logging, and retry-safe recording processing.

* **Chores**
* Added cross-platform native audio capture and Ogg/Opus encoding
support.

* **Tests**
* New unit, integration, and e2e tests for recording, path guards,
dialogs, and workspace recovery.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/electron/test/workspace/handlers.spec.ts

@@ -131,4 +131,52 @@ describe('workspace db management', () => {
       )
     ).toBe(false);
   });
+
+  test('rejects unsafe ids when deleting a workspace', async () => {
+    const { deleteWorkspace } =
+      await import('@affine/electron/helper/workspace/handlers');
+    const outsideDir = path.join(tmpDir, 'outside-delete-target');
+
+    await fs.ensureDir(outsideDir);
+
+    await expect(
+      deleteWorkspace(
+        universalId({
+          peer: 'local',
+          type: 'workspace',
+          id: '../../outside-delete-target',
+        })
+      )
+    ).rejects.toThrow('Invalid workspace id');
+
+    expect(await fs.pathExists(outsideDir)).toBe(true);
+  });
+
+  test('rejects unsafe ids when deleting backup workspaces', async () => {
+    const { deleteBackupWorkspace } =
+      await import('@affine/electron/helper/workspace/handlers');
+    const outsideDir = path.join(tmpDir, 'outside-backup-target');
+
+    await fs.ensureDir(outsideDir);
+
+    await expect(
+      deleteBackupWorkspace('../../outside-backup-target')
+    ).rejects.toThrow('Invalid workspace id');
+
+    expect(await fs.pathExists(outsideDir)).toBe(true);
+  });
+
+  test('rejects unsafe ids when recovering backup workspaces', async () => {
+    const { recoverBackupWorkspace } =
+      await import('@affine/electron/helper/workspace/handlers');
+    const outsideDir = path.join(tmpDir, 'outside-recover-target');
+
+    await fs.ensureDir(outsideDir);
+
+    await expect(
+      recoverBackupWorkspace('../../outside-recover-target')
+    ).rejects.toThrow('Invalid workspace id');
+
+    expect(await fs.pathExists(outsideDir)).toBe(true);
+  });
 });