fix: production-ready build pipeline + audit_device() crash

- fingerprint.py: audit_device() crashed with "cannot unpack non-iterable
  bool" because of a stray `webrtc_ok, _ = ... and True or False` line.
  Replaced with a proper Chrome+Edge registry probe using _WEBRTC_*
  module constants.

- ProxyChainManager.spec: removed the hardcoded absolute run.py path,
  resolve everything relative to SPECPATH so the spec is portable on any
  machine / CI runner. Bundled signup_extension/ and world_map.png as
  data files (these were missing — the runtime would fall back to drawn
  landmasses and the signup browser extension would 404 in the frozen
  build). Added PIL._tkinter_finder hidden import for safety.

- scripts/setup_and_build.ps1: build now uses the spec file instead of
  re-deriving CLI flags. The old `--onefile --windowed --collect-all
  customtkinter` invocation IGNORED the spec and silently dropped the
  bundled data files. Also added explicit $LASTEXITCODE check.

Verified end-to-end: clean PyInstaller build produces a 32MB exe with
signup_extension (8 TOC entries), world_map.png (4), customtkinter
(365) all present.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/setup_and_build.ps1

@@ -38,14 +38,14 @@ Write-Host "`n== dependencies + PyInstaller =="
 & $py -m pip install -r "$root\requirements.txt"
 & $py -m pip install pyinstaller
 
-Write-Host "`n== PyInstaller =="
-& $py -m PyInstaller --noconfirm --clean `
-    --onefile --windowed `
-    --uac-admin `
-    --name ProxyChainManager `
-    --collect-all customtkinter `
-    --hidden-import pystray._win32 `
-    "$root\run.py"
+Write-Host "`n== PyInstaller (using ProxyChainManager.spec) =="
+# Always build from the spec — it bundles signup_extension/, world_map.png,
+# customtkinter assets, and the right hidden imports. Do NOT override with
+# CLI flags or the data files will be missing from the .exe.
+$spec = Join-Path $root "ProxyChainManager.spec"
+if (-not (Test-Path $spec)) { throw "Spec not found: $spec" }
+& $py -m PyInstaller --noconfirm --clean $spec
+if ($LASTEXITCODE -ne 0) { throw "PyInstaller failed (exit $LASTEXITCODE)" }
 
 $distExe = Join-Path $root "dist\ProxyChainManager.exe"
 if (-not (Test-Path $distExe)) {