fix: register PureMac with TCC so Full Disk Access works (#75) + dashboard redesign

[ceorkm]

Closes #75 (and likely #78 — same root cause).

The bug

PureMac never appears in System Settings → Privacy & Security → Full Disk Access, even after a fresh install via Homebrew. Granting FDA manually with the + button doesn't help — the uninstaller still fails with "files could not be removed."

The reason is that the uninstaller delegated deletions to Finder via NSAppleScript. macOS records the Finder process as the requester for those file syscalls, so PureMac itself never tripped TCC and never got registered in the FDA pane. Granting access to PureMac was a no-op because PureMac wasn't the process being blocked.

What changed

Fixes

• Replaced the AppleScript-via-Finder bridge with FileManager.trashItem, so the syscall originates from PureMac and TCC registers it.
• Added FullDiskAccessManager.triggerRegistration() invoked at launch, which performs real reads on a few protected paths (/Library/Application Support/com.apple.TCC/TCC.db, ~/Library/Mail, ~/Library/Safari/CloudTabs.db). Forces TCC registration on first run.
• Added recovery helpers for the cases reported in the issue thread: a "Reveal PureMac" button (drag-into-list workaround for Homebrew installs that strip the quarantine attribute) and a "Reset & re-prompt" action that runs tccutil reset SystemPolicyAllFiles com.puremac.app for the stale-bundle case.
• Strengthened FDA detection: real FileHandle/contentsOfDirectory reads instead of isReadableFile metadata calls, since metadata calls don't always trigger TCC.
• Info.plist gains NSDesktopFolderUsageDescription, NSDocumentsFolderUsageDescription, NSDownloadsFolderUsageDescription, NSRemovableVolumesUsageDescription, NSSystemAdministrationUsageDescription, NSAppleEventsUsageDescription so the OS surfaces per-folder consent prompts.

Cleaning fixes (surfaced while debugging)

• Extended isSafeToDelete allow-list with the dev-cache roots scanners actually emit (~/Library/Developer/Xcode/DerivedData, Xcode/Archives, CoreSimulator/Caches, ~/.npm, ~/.cache, ~/Library/Containers/com.docker.docker) and /var/log / /var/tmp (the symlink-resolved forms of /private/var/...). System log/tmp deletion was silently failing the safety check before.
• isSafeToDelete now accepts whole-root paths (path == root), not just paths inside roots. Xcode/Brew/Node scanners emit at the root, so they were getting silently skipped.
• CleaningResult.cleanedPaths tracks what actually got deleted; the UI now removes only those items instead of wiping the list and pretending success.
• Permission-denied failures get routed to a single admin-privileged batch via do shell script "xargs -0 /bin/rm -rf -- < <tempfile>" with administrator privileges. One auth prompt covers the whole batch. Paths are re-validated against the safety allow-list before escalation, passed via NUL-separated tempfile so quoting can't go wrong, and post-stat'd to confirm what disappeared.
• cleanError now surfaces a real failure dialog with paths logged to Logger, instead of fake-succeeding.

Other fixes flagged in the issue comments

• Directory sizes were rendering as 0 B because attributesOfItem(.size) returns the directory's metadata size, not its contents. AppFilesView and OrphanListView now use totalFileAllocatedSizeKey.
• Removed a depth > 5000 { break } cap from scanLargeFiles that bailed after 5,000 enumerated entries. With 600,000+ files in Downloads/Documents/Desktop, the scan never reached anything actually large.

UI overhaul

• Storage-led dashboard replaces the old Smart Scan landing: % used gauge (gradient turns orange/red over 85%), free-space numerals, stacked usage bar with legend, four stat tiles, contextual suggestions.
• Sidebar redesigned with tinted icon tiles per row, capsule size badges, and a persistent system-health footer that turns orange when FDA isn't granted.
• Category detail pages get a hero card with the tinted icon, description, item count + size, and a rescan action.
• Flat orange FDA bar replaced with a gradient toast card that matches the dashboard surfaces.
• Onboarding now walks the user through Settings step-by-step (intro → numbered instructions → granted), auto-advances when access is detected, includes a "Trouble?" menu with reveal/reset/diagnostics.
• Toolbar gets a 3-segment appearance pill (system / light / dark) with a sliding indicator. ThemeManager persists the preference via AppStorage.
• docs/ui-prototype/{old,new}.html are clickable HTML mockups of the previous and proposed designs, included for design review.

Test plan

• Build succeeds (xcodebuild -project PureMac.xcodeproj -scheme PureMac build)
• Fresh launch with onboarding reset registers PureMac in System Settings → Privacy & Security → Full Disk Access
• Granting FDA and running Smart Scan → Clean actually deletes user-owned items (e.g. ~/.npm/_cacache)
• Root-owned items (/Library/Caches/*, /private/var/log/*) trigger the admin auth prompt and get deleted via the privileged pass
• Large & Old Files scan finds items beyond the previous 5k cap on a Mac with 600k+ files in user folders
• Light / dark / system appearance toggle persists across launches