feat(apple): saved devices and targeted transfers UI

Adds the native SwiftUI Saved Devices experience on top of the production
saved-device core, as a top-level destination in the iOS tab bar and the
macOS sidebar.

Core seam:
- App-facing saved-device domain models mirroring core/SavedDeviceModels.kt,
  with lifecycle helpers (canReceive/canResume/canCancel/canDelete) so views
  never hand-roll state checks.
- 21 gateway methods through CoreGateway/CoreRepository with UniFFI mapping.
  cancelTargetedTransfer, forgetSavedDevice and blockDevice run off the serial
  lane: each must reach the core while a targeted receive is blocking it.
- Payload-free pairingChanged/targetedTransferChanged signals, dispatched
  before the numeric-transferId guard since saved-device events identify
  their subject by peer endpoint or a string transfer id.

Experience:
- Screen lists saved devices and outstanding consent requests only; the
  global targeted-transfer history stays out, reachable per device.
- Details as a sheet with detents on compact layouts and a native inspector
  on macOS, owning Send, label, forget/block and that device's transfers.
- Label editing is transactional: the draft and editor survive a failed
  write, conflicting actions are refused while saving, and the editor closes
  only after the core confirms.
- Pairing and targeted-offer consent hosted at the app root, answerable from
  any tab and suppressed while a transfer approval is up. Dismissing a
  pairing prompt suppresses locally without consuming the single-use
  eligibility; dismissing an offer declines it, since an unanswered offer
  holds a slot in the core's bounded per-sender queue.
- Targeted send reuses the invitation composer's affordances with file,
  folder, rename, replace and cleanup parity. Picker copies are released on
  replace/remove/clear/cancel and after a successful create, but kept after a
  failure so retry does not require re-picking.
- Notifications for pairing requests and offers (withdrawn once answered) and
  for terminal targeted transfers. Wording follows direction: on the sending
  device the peer finished receiving, not us.

Localization:
- Widens 52 saved-device keys from kmp-only to both platforms.
- Five keys carried a literal %1$s with no declared args, which Compose
  renders positionally but the Apple generator emits as a plain constant,
  leaking the placeholder into the UI. They now use named args; Compose
  output is byte-identical.
- Adds targeted_offer_title/body. Reusing the invitation approval copy stated
  the roles backwards, announcing the sender as the receiver.

Also surfaces core startup failures: the startup overlay is drawn above the
snackbar host, so a failed initialize() was indistinguishable from an app
that never finished loading. AppModel now keeps the reason, logs it, and the
overlay shows it with a retry, plus the technical detail in DEBUG builds.

Send and receive between two devices is verified only partially; a missing
endpoint-identity credential currently blocks startup on the test device.

apple/Tests/SavedDeviceNotificationTests.swift

@@ -0,0 +1,167 @@
+import XCTest
+@testable import VniDrop
+
+@MainActor
+final class SavedDeviceNotificationTests: XCTestCase {
+	private static let peer = "peer-endpoint"
+
+	private func state(
+		pendingRelationships: [DeviceRelationshipModel] = [],
+		eligibilities: [PairingEligibilityModel] = [],
+		savedDevices: [SavedDeviceModel] = [],
+		offers: [PendingTargetedOfferModel] = [],
+		senderDisplayNames: [String: String] = [:],
+		transfers: [SavedDeviceTransferItem] = []
+	) -> SavedDevicesState {
+		var state = SavedDevicesState()
+		state.isLoading = false
+		state.pendingRelationships = pendingRelationships
+		state.eligibilities = eligibilities
+		state.savedDevices = savedDevices
+		state.targetedOffers.pending = offers
+		state.targetedOffers.senderDisplayNames = senderDisplayNames
+		state.targetedTransfers = transfers
+		return state
+	}
+
+	private func relationship(_ state: DeviceRelationshipStateModel) -> DeviceRelationshipModel {
+		DeviceRelationshipModel(
+			remoteEndpointId: Self.peer, state: state, generation: 1,
+			minimumProtocolVersion: 1, createdAt: 1, updatedAt: 1
+		)
+	}
+
+	private func offer(_ transferId: String = "t1") -> PendingTargetedOfferModel {
+		PendingTargetedOfferModel(
+			transferId: transferId, senderEndpointId: Self.peer, receiverEndpointId: "me",
+			manifestId: "m", contentHash: "h", transferName: "Photos", fileCount: 1,
+			totalSize: 10, protocolVersion: 1, receivedAt: 1
+		)
+	}
+
+	private func transferItem(
+		id: String = "t1",
+		state: TargetedTransferStateModel,
+		direction: SavedDeviceTransferDirection = .incoming
+	) -> SavedDeviceTransferItem {
+		SavedDeviceTransferItem(
+			id: id, peerEndpointId: Self.peer, peerDisplayName: "Studio Mac",
+			direction: direction, transferName: "Photos", fileCount: 1, totalSize: 10,
+			verifiedBytes: 10, state: state, createdAt: 1, updatedAt: 1
+		)
+	}
+
+	// MARK: - Prompts
+
+	func testIncomingPairingRequestIsPlanned() {
+		let planned = plannedSavedDevicePrompts(state(pendingRelationships: [relationship(.pendingIncoming)]))
+
+		XCTAssertEqual(planned.map(\.kind), [.pairingRequest])
+		XCTAssertEqual(planned.first?.id, "pairing-request-\(Self.peer)")
+	}
+
+	func testOutgoingPairingRequestIsNotPlanned() {
+		// We are the ones waiting; there is nothing for the user to answer.
+		let planned = plannedSavedDevicePrompts(state(pendingRelationships: [relationship(.pendingOutgoing)]))
+
+		XCTAssertTrue(planned.isEmpty)
+	}
+
+	func testPairingRequestUsesEligibilityNameWhenAvailable() {
+		let eligibility = PairingEligibilityModel(
+			peerEndpointId: Self.peer, remoteDisplayName: "Alice's Mac", sessionId: "s",
+			protocolVersion: 1, createdAt: 1, expiresAt: 2
+		)
+		let planned = plannedSavedDevicePrompts(state(
+			pendingRelationships: [relationship(.pendingIncoming)],
+			eligibilities: [eligibility]
+		))
+
+		XCTAssertEqual(planned.first?.deviceName, "Alice's Mac")
+	}
+
+	func testPendingOfferIsPlannedWithSenderNameOnlyWhenSaved() {
+		let unnamed = plannedSavedDevicePrompts(state(offers: [offer()]))
+		XCTAssertEqual(unnamed.map(\.kind), [.targetedOffer])
+		// An unsaved sender has no name we can vouch for.
+		XCTAssertNil(unnamed.first?.deviceName)
+
+		let named = plannedSavedDevicePrompts(state(
+			offers: [offer()],
+			senderDisplayNames: [Self.peer: "Studio Mac"]
+		))
+		XCTAssertEqual(named.first?.deviceName, "Studio Mac")
+	}
+
+	func testPromptIdsAreStablePerSubject() {
+		// Stable ids are what let the coordinator withdraw a prompt once answered.
+		let first = plannedSavedDevicePrompts(state(offers: [offer()]))
+		let second = plannedSavedDevicePrompts(state(offers: [offer()]))
+
+		XCTAssertEqual(first.map(\.id), second.map(\.id))
+	}
+
+	// MARK: - Terminal outcomes
+
+	func testCompletedAndFailedTransfersArePlanned() {
+		let planned = plannedTargetedOutcomes(
+			[transferItem(id: "a", state: .completed), transferItem(id: "b", state: .failed)],
+			published: []
+		)
+
+		XCTAssertEqual(planned.map(\.kind), [.targetedReceiveCompleted, .targetedReceiveFailed])
+	}
+
+	func testOutcomeWordingFollowsDirection() {
+		// On the sending device it is the *peer* that finished downloading. Using
+		// the receive wording here told the sender it had downloaded its own files.
+		let outgoing = plannedTargetedOutcomes(
+			[
+				transferItem(id: "a", state: .completed, direction: .outgoing),
+				transferItem(id: "b", state: .failed, direction: .outgoing),
+			],
+			published: []
+		)
+		XCTAssertEqual(outgoing.map(\.kind), [.targetedSendCompleted, .targetedSendFailed])
+
+		let incoming = plannedTargetedOutcomes(
+			[transferItem(id: "c", state: .completed, direction: .incoming)],
+			published: []
+		)
+		XCTAssertEqual(incoming.map(\.kind), [.targetedReceiveCompleted])
+	}
+
+	func testIdsDoNotCollideAcrossDirections() {
+		let incoming = plannedTargetedOutcomes([transferItem(state: .completed)], published: [])
+		let outgoing = plannedTargetedOutcomes(
+			[transferItem(state: .completed, direction: .outgoing)], published: []
+		)
+
+		XCTAssertNotEqual(incoming.first?.id, outgoing.first?.id)
+	}
+
+	func testUserDrivenTerminalStatesAreNotPlanned() {
+		// The user already knows: they cancelled or declined it themselves.
+		let planned = plannedTargetedOutcomes(
+			[
+				transferItem(id: "a", state: .cancelled),
+				transferItem(id: "b", state: .declined),
+				transferItem(id: "c", state: .transferring),
+			],
+			published: []
+		)
+
+		XCTAssertTrue(planned.isEmpty)
+	}
+
+	func testAlreadyPublishedOutcomesAreNotReplanned() {
+		let first = plannedTargetedOutcomes([transferItem(state: .completed)], published: [])
+		XCTAssertEqual(first.count, 1)
+
+		let second = plannedTargetedOutcomes(
+			[transferItem(state: .completed)],
+			published: Set(first.map(\.id))
+		)
+		XCTAssertTrue(second.isEmpty)
+	}
+}