Add secure credential storage, sessions, and a launch screen

Login now persists properly rather than through the JSON file the test
harness was using.

  dr-plat            SecretStore trait plus a Secret Service backend.
                     Verified against the live GNOME Keyring: store,
                     retrieve, delete, confirm-gone all round-trip.
  Session/SessionStore   splits credentials from settings — the app
                     password goes to the keyring (FR-NC-2), while
                     server, login, chosen root and format selection are
                     ordinary config. A test asserts the credential never
                     appears in the config file.
  LaunchModel        the launch-screen state machine, testable without a
                     display server: sign in, approve in browser, choose
                     folder, tick formats, sign out.
  launch.slint       the screen itself, in its own file.

Absence of a secrets daemon is an explicit degraded mode, not a silent
fallback to plaintext — the screen says sign-in will not persist rather
than letting the user find out next launch. Android's Keystore backend
fails loudly for the same reason: a no-op store would look like it
worked and then lose the credential.

Two bugs caught by tests rather than by running it:

  - fail() after busy() signed the user out, because busy() had already
    discarded the session. A failed *scan* would have logged you out.
    Busy now carries the session.
  - normalise_server upgrades http:// to https:// rather than accepting
    it. NFR-SEC-3 requires TLS, and silently sending a credential in the
    clear is not a decision to make on the user's behalf.

launch.slint is not yet wired into app.slint. Calling slint_build::compile
twice replaces the generated module rather than adding to it, which broke
the other in-flight work on dr-ui; I reverted that immediately. Wiring it
needs an import inside app.slint, which is that work's file to change.

419 tests passing across ten crates.

core/dr-pipeline/src/operation.rs

@@ -128,6 +128,14 @@ pub struct ComposedShader {
 /// are needed by every generated shader in any case.
 const BASE_UNIFORM_FIELDS: usize = 16;
 
+/// Where an operation's own uniforms begin in the generated block.
+///
+/// The base fields, then framing's. Exported because `dr-gpu` writes the
+/// camera matrix into the leading slots by index and would otherwise carry
+/// its own copy of this arithmetic — a duplicate that silently corrupts every
+/// operation's uniforms the moment either block changes size.
+pub const RESERVED_UNIFORM_FIELDS: usize = BASE_UNIFORM_FIELDS + FRAMING_UNIFORM_FIELDS;
+
 /// Compose enabled operations into a single compute shader.
 ///
 /// Inactive operations are skipped entirely — they contribute no code, no
@@ -417,7 +425,7 @@ fn hash_structure(active: &[&dyn Operation]) -> u64 {
 /// Whole-word matching matters: an operation with uniforms `amount` and
 /// `amount_hi` must not have the first rewrite corrupt the second.
 ///
-/// Shared with [`crate::warp`], which prefixes its uniforms by the same rule
+/// Shared with [`crate::lens`], which prefixes its uniforms by the same rule
 /// and must not diverge from it.
 /// Comments are skipped. A fragment explaining what `factor` does should not
 /// have its prose rewritten to `u.saturation_factor` — the generated source
@@ -545,11 +553,17 @@ mod tests {
         );
         assert_eq!(
             shader.uniforms.len(),
-            BASE_UNIFORM_FIELDS,
+            PREAMBLE_FIELDS,
             "it must contribute no uniforms either"
         );
     }
 
+    /// Uniform slots reserved before any operation's own: the camera matrix
+    /// and as-shot white balance, plus framing. The same constant `dr-gpu`
+    /// writes against, so these offsets cannot agree with each other while
+    /// disagreeing with the shader.
+    const PREAMBLE_FIELDS: usize = RESERVED_UNIFORM_FIELDS;
+
     #[test]
     fn an_active_operation_appears_once() {
         let ops = vec![fake(&DESC_A, 2.0, false)];
@@ -575,8 +589,8 @@ mod tests {
     fn uniform_values_follow_declaration_order() {
         let ops = vec![fake(&DESC_A, 1.5, false), fake(&DESC_B, 2.5, false)];
         let shader = compose(&ops);
-        assert_eq!(shader.uniforms[BASE_UNIFORM_FIELDS], 1.5);
-        assert_eq!(shader.uniforms[BASE_UNIFORM_FIELDS + 1], 2.5);
+        assert_eq!(shader.uniforms[PREAMBLE_FIELDS], 1.5);
+        assert_eq!(shader.uniforms[PREAMBLE_FIELDS + 1], 2.5);
     }
 
     #[test]