Wire the launch screen into the app

The app now opens on the login screen when there is nothing else to show
— no local paths and no configured library — and goes straight to the
images otherwise. Making someone click past a login they already
completed is pure friction.

  launch.slint       imported by app.slint, replacing the window rather
                     than overlaying it: there is no library to look at
                     until an account is configured
  launch_ui.rs       the Slint wiring, kept out of lib.rs so the launch
                     flow can change without touching the develop window

Login runs on a worker thread and posts results back through a channel,
since Slint's event loop is single-threaded and a 20-minute browser wait
cannot block it. The system browser is opened via xdg-open, never an
embedded webview (FR-NC-1).

Sign-out deletes the local credential even if server-side revocation
fails: a network error must not leave a usable secret on the machine.
Format tick-boxes persist on each toggle, so a selection survives a
crash before the library is opened.

Two things deliberately incomplete rather than faked:

  - "Choose folder" lists the account's folders and reports them, but
    there is no picker widget yet, so selection still happens via the
    connect example.
  - "Open library" logs the request. Opening a remote library needs the
    scan-and-cache path, which belongs with the catalog work in flight.

Earlier I broke the other in-flight dr-ui work by calling
slint_build::compile twice, which replaces the generated module. The
correct wiring is an import inside app.slint, which is what this does.

30 dr-ui tests passing; both launch paths verified by running the app.

ui/dr-ui/src/lib.rs

@@ -27,6 +27,7 @@ use dr_decode::{Metadata, PreviewSize};
 pub use develop::DevelopSession;
 
 pub mod launch;
+pub mod launch_ui;
 
 slint::include_modules!();
 
@@ -203,6 +204,24 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
 
     let window = AppWindow::new()?;
 
+    // Launch screen: shown when there is nothing to display — no local paths
+    // and no configured library. A user who has already signed in and chosen
+    // a folder goes straight to their images (FR-NC-1).
+    {
+        let controller = launch_ui::LaunchController::new();
+        let show = controller.should_show(!paths.is_empty());
+        window.set_show_launch(show);
+        launch_ui::wire(&window, controller, |session| {
+            // Opening a remote library needs the scan-and-cache path, which
+            // lands with the catalog. Reporting that plainly beats a button
+            // that silently does nothing.
+            log::info!("open library requested for {}", session.describe());
+        });
+        if show {
+            log::info!("no library configured — showing the launch screen");
+        }
+    }
+
     // The device is shared by demosaic and the adjust pass. Without one the
     // app still browses through the preview path, just without develop.
     let gpu = match pollster::block_on(dr_gpu::GpuContext::new_headless()) {