[httpsphl]

What

D4c (spec 24.7, 24.10). It sits on top of #178, so this diff shows it too until it merges. With this, D4 is complete.

• Switch in the bot's details:
  • each grant to use an app gets a "Real mouse and keyboard" switch, off from the start; grants to only see don't get one;
  • turning it on first opens a dialog that says what changes:
    • the bot moves the cursor and types as the owner would, when accessibility can't;
    • while it acts, the mouse and keyboard are its, and a notice on screen says so;
    • moving the mouse or pressing a key stops it at once, and Ctrl+Alt+Esc stops every bot;
    • it never types in password fields and never presses Windows' own keys;
  • turning it off happens at once, with no dialog;
  • the app calls desktop.setOptions.
• Notice on the owner's screen while a bot uses the real mouse and keyboard:
  • a thin border in the bot's color around the monitor the app's window is on;
  • a dark pill at the top: "Scout is using your mouse and keyboard. Move the mouse to stop it."
  • It is a layered window of its own, on its own thread: always on top, clicks pass through (WS_EX_TRANSPARENT), it never takes focus, never appears in the window list, and never shows up in another window's picture.
  • It appears before each real action and goes away 3 seconds after the last.
• Notice language:
  • the words live in the daemon, in the app's three languages, because the app may be closed;
  • the app sends its language with session.hello (client.locale) and with the new session.setLocale when the owner changes it;
  • with no language known, it uses English.
• Spec 24.7, 24.10 and section 24's status (D4 implemented) are updated.

Checks

• cargo fmt, clippy -D warnings and pnpm check pass.
• App tests (realInput.test.tsx):
  • the switch is off and only appears on grants to use;
  • the dialog says what changes, and Cancel leaves it off;
  • Turn on turns it on, and turning it off happens at once;
  • a language change reaches the fake daemon.
• Daemon tests:
  • the notice text in each language and the bot's color;
  • session.setLocale reaches the daemon.
• On CI's Windows runner only: a real click goes through the notice and reaches the window.
• Manual: see the notice on a real screen while a bot uses Notepad with the switch on, then move the mouse.