feat(audit): Batch 20 — Windows/main-process (UI23, W12, W15, L131)

UI23: cookie sign-in + PO-token windows open with the app's resolved
theme background (passed from the IPC layer), no more white flash.
W12: multi-resolution fallback tray icon (16/24/32/48 via
addRepresentation dataURL, embedded in trayFallbackIcons.ts); decode +
scale factors verified in an Electron probe.
W15: hardwareAcceleration setting (default false = software rendering);
index.ts gates disableHardwareAcceleration on it after the portable
redirect; Appearance card switch with restart note; boot path verified.
L131: resolved by-design — clearing the queue acknowledges failures;
flashFrame (W10) covers attention, Diagnostics persists the record.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/main/index.ts

@@ -29,23 +29,28 @@ import { initialWindowState, saveWindowState } from './windowState'
 const isPrimaryInstance = app.requestSingleInstanceLock()
 if (!isPrimaryInstance) app.quit()
 
-// Force software compositing (GPU acceleration off). On this dev machine's old GeForce
-// GT 625 — and plausibly on the old / locked-down public PCs this app targets —
-// Chromium's GPU compositor renders blank: under hardware acceleration the WHOLE window
-// paints white (popup overlays alone were blank earlier). Updating the NVIDIA driver to
-// the last Fermi release did not fix it. Software compositing renders correctly and
-// costs no meaningful performance for this lightweight UI, so it is the safe default for
-// this app's target hardware. The only downside is a minor overlay-repaint flicker that
-// appears on the most broken GPUs. The window backgroundColor is theme-matched (see
-// createWindow); native window-occlusion tracking is disabled (a separate documented
-// Windows blank/flicker cause). Must run before the app is ready.
-app.disableHardwareAcceleration()
-app.commandLine.appendSwitch('disable-features', 'CalculateNativeWinOcclusion')
-
 // Redirect user data next to the exe when possible (portable, no-admin). Must run
-// before the app is ready and before any user path is read.
+// before the app is ready and before any user path is read — including the
+// settings read for the hardware-acceleration gate just below.
 setupPortableData()
 
+// Software compositing (GPU acceleration off) is the DEFAULT, now behind an
+// opt-in setting (W15). On this dev machine's old GeForce GT 625 — and plausibly
+// on the old / locked-down public PCs this app targets — Chromium's GPU
+// compositor renders blank: under hardware acceleration the WHOLE window paints
+// white (popup overlays alone were blank earlier). Updating the NVIDIA driver to
+// the last Fermi release did not fix it. Software compositing renders correctly
+// and costs no meaningful performance for this lightweight UI, so it stays the
+// safe default; users on modern GPUs can flip Settings → Appearance →
+// "Hardware acceleration" (applies on next launch — this must run before the
+// app is ready). The window backgroundColor is theme-matched (see createWindow).
+if (!getSettings().hardwareAcceleration) {
+  app.disableHardwareAcceleration()
+}
+// Native window-occlusion tracking stays off in BOTH modes — it's a separate
+// documented Windows blank/flicker cause, independent of GPU compositing.
+app.commandLine.appendSwitch('disable-features', 'CalculateNativeWinOcclusion')
+
 // Register aerofetch:// so a browser/another app can hand AeroFetch a link
 // (?url=<encoded>) the way Android's share sheet hands Seal one. The NSIS
 // installer also declares this scheme (electron-builder.yml's `protocols`)