Add secure credential storage, sessions, and a launch screen

Login now persists properly rather than through the JSON file the test
harness was using.

  dr-plat            SecretStore trait plus a Secret Service backend.
                     Verified against the live GNOME Keyring: store,
                     retrieve, delete, confirm-gone all round-trip.
  Session/SessionStore   splits credentials from settings — the app
                     password goes to the keyring (FR-NC-2), while
                     server, login, chosen root and format selection are
                     ordinary config. A test asserts the credential never
                     appears in the config file.
  LaunchModel        the launch-screen state machine, testable without a
                     display server: sign in, approve in browser, choose
                     folder, tick formats, sign out.
  launch.slint       the screen itself, in its own file.

Absence of a secrets daemon is an explicit degraded mode, not a silent
fallback to plaintext — the screen says sign-in will not persist rather
than letting the user find out next launch. Android's Keystore backend
fails loudly for the same reason: a no-op store would look like it
worked and then lose the credential.

Two bugs caught by tests rather than by running it:

  - fail() after busy() signed the user out, because busy() had already
    discarded the session. A failed *scan* would have logged you out.
    Busy now carries the session.
  - normalise_server upgrades http:// to https:// rather than accepting
    it. NFR-SEC-3 requires TLS, and silently sending a credential in the
    clear is not a decision to make on the user's behalf.

launch.slint is not yet wired into app.slint. Calling slint_build::compile
twice replaces the generated module rather than adding to it, which broke
the other in-flight work on dr-ui; I reverted that immediately. Wiring it
needs an import inside app.slint, which is that work's file to change.

419 tests passing across ten crates.

core/dr-pipeline/src/ops/distortion.rs

@@ -1,7 +1,7 @@
 //! Geometric distortion correction.
 //!
 //! Straightens the lines a lens bends: barrel distortion on wide angles,
-//! pincushion on telephotos. A [`crate::warp::Warp`] rather than an
+//! pincushion on telephotos. A [`crate::lens::Warp`] rather than an
 //! [`crate::operation::Operation`], because it changes *where* a pixel is read
 //! from rather than what its value becomes.
 //!
@@ -26,11 +26,9 @@
 //! profile is a "make the horizon straight" task, which one term does well.
 //! The full triple is reachable by loading a profile.
 
-use crate::descriptor::{
-    LocalizedKey, OpDescriptor, OpId, ParamDescriptor, ParamId, Scale, Unit,
-};
+use crate::descriptor::{LocalizedKey, OpDescriptor, OpId, ParamDescriptor, ParamId, Scale, Unit};
+use crate::lens::Warp;
 use crate::operation::{Helper, Uniform};
-use crate::warp::Warp;
 
 pub const ID: OpId = OpId("distortion");
 pub const AMOUNT: ParamId = ParamId("amount");