fix(window): renderer path off-by-one; use 'close' for state save

Two related bugs in src/main/window/index.js:

1. Renderer path was ../../dist/renderer/index.html which resolves to
   src/dist/renderer/index.html (one level too deep). Production builds
   load from <project>/dist/renderer/index.html. Fix: ../../..

   This was never caught because dev mode uses VITE_DEV_SERVER_URL and
   never touches the file path; only 'electron .' (no Vite) hits it.

2. win.on('closed', state.save) calls win.getBounds() on a destroyed
   BrowserWindow. The 'closed' event fires AFTER destruction, so
   getBounds() throws 'Object has been destroyed'. Use 'close' (fires
   before destruction) and guard with isDestroyed() as a belt-and-suspenders.

Both bugs surfaced when the user clicked File → Open. The renderer
loaded a missing HTML (blank body); the openFile handler then triggered
the closed-event state save which threw.

src/main/window/index.js

@@ -38,7 +38,7 @@ function createMainWindow() {
   } else {
     const rendererIndex = app.isPackaged
       ? path.join(process.resourcesPath, 'renderer', 'index.html')
-      : path.join(__dirname, '../../dist/renderer/index.html');
+      : path.join(__dirname, '../../../dist/renderer/index.html');
 
     if (app.isPackaged) {
       try {
@@ -63,8 +63,10 @@ function createMainWindow() {
 
   menu.register(win);
 
-  win.on('closed', () => {
-    state.save(win);
+  // Use 'close' (fires before destruction) — 'closed' fires after the
+  // BrowserWindow object is destroyed, so getBounds() would throw.
+  win.on('close', () => {
+    if (!win.isDestroyed()) state.save(win);
   });
 
   // Spell check context menu