fix: replace user-reachable panics in window/shortcut paths

- window.rs: return Err for unknown url_type instead of panic; fall back
  to default product_name and empty JSON on missing/invalid config so a
  malformed pake.json no longer crashes launch
- setup.rs: skip shortcut handler invocation on Mutex poisoning instead
  of propagating panic, preventing all future shortcut triggers from
  silently failing after the first panic