feat(apple): saved devices and targeted transfers UI

Adds the native SwiftUI Saved Devices experience on top of the production
saved-device core, as a top-level destination in the iOS tab bar and the
macOS sidebar.

Core seam:
- App-facing saved-device domain models mirroring core/SavedDeviceModels.kt,
  with lifecycle helpers (canReceive/canResume/canCancel/canDelete) so views
  never hand-roll state checks.
- 21 gateway methods through CoreGateway/CoreRepository with UniFFI mapping.
  cancelTargetedTransfer, forgetSavedDevice and blockDevice run off the serial
  lane: each must reach the core while a targeted receive is blocking it.
- Payload-free pairingChanged/targetedTransferChanged signals, dispatched
  before the numeric-transferId guard since saved-device events identify
  their subject by peer endpoint or a string transfer id.

Experience:
- Screen lists saved devices and outstanding consent requests only; the
  global targeted-transfer history stays out, reachable per device.
- Details as a sheet with detents on compact layouts and a native inspector
  on macOS, owning Send, label, forget/block and that device's transfers.
- Label editing is transactional: the draft and editor survive a failed
  write, conflicting actions are refused while saving, and the editor closes
  only after the core confirms.
- Pairing and targeted-offer consent hosted at the app root, answerable from
  any tab and suppressed while a transfer approval is up. Dismissing a
  pairing prompt suppresses locally without consuming the single-use
  eligibility; dismissing an offer declines it, since an unanswered offer
  holds a slot in the core's bounded per-sender queue.
- Targeted send reuses the invitation composer's affordances with file,
  folder, rename, replace and cleanup parity. Picker copies are released on
  replace/remove/clear/cancel and after a successful create, but kept after a
  failure so retry does not require re-picking.
- Notifications for pairing requests and offers (withdrawn once answered) and
  for terminal targeted transfers. Wording follows direction: on the sending
  device the peer finished receiving, not us.

Localization:
- Widens 52 saved-device keys from kmp-only to both platforms.
- Five keys carried a literal %1$s with no declared args, which Compose
  renders positionally but the Apple generator emits as a plain constant,
  leaking the placeholder into the UI. They now use named args; Compose
  output is byte-identical.
- Adds targeted_offer_title/body. Reusing the invitation approval copy stated
  the roles backwards, announcing the sender as the receiver.

Also surfaces core startup failures: the startup overlay is drawn above the
snackbar host, so a failed initialize() was indistinguishable from an app
that never finished loading. AppModel now keeps the reason, logs it, and the
overlay shows it with a retry, plus the technical detail in DEBUG builds.

Send and receive between two devices is verified only partially; a missing
endpoint-identity credential currently blocks startup on the test device.

apple/VniDrop/Core/CoreGateway.swift

@@ -47,4 +47,51 @@ protocol CoreGateway: AnyObject {
 	func receiverRequests(transferId: UInt64) async -> Result<[ReceiverRequestModel], Error>
 	func respondReceiverRequest(requestId: String, accepted: Bool, reason: String?) async -> Result<Void, Error>
 	func refresh() async -> Result<Void, Error>
+
+	// MARK: - Saved devices
+
+	func listPairingEligibilities() async -> Result<[PairingEligibilityModel], Error>
+	func declinePairingEligibility(peerEndpointId: String) async -> Result<Void, Error>
+	/// Asks a peer to pair. Returns false when no valid eligibility exists, which
+	/// the core rejects silently so a stranger cannot provoke a prompt.
+	func requestSavedDevicePairing(peerEndpointId: String) async -> Result<Bool, Error>
+	func respondToDevicePairing(peerEndpointId: String, accepted: Bool) async -> Result<Bool, Error>
+	func listDeviceRelationships() async -> Result<[DeviceRelationshipModel], Error>
+	func listSavedDevices() async -> Result<[SavedDeviceModel], Error>
+	/// Sets or clears (`nil`) the user-owned local label.
+	func setSavedDeviceLabel(peerEndpointId: String, label: String?) async -> Result<Void, Error>
+	func forgetSavedDevice(peerEndpointId: String) async -> Result<Void, Error>
+	func blockDevice(peerEndpointId: String) async -> Result<Void, Error>
+	/// Removes only the deny rule. Grants, relationships, and cancelled transfers
+	/// are not restored — re-saving needs another qualifying transfer and consent.
+	func unblockDevice(peerEndpointId: String) async -> Result<Void, Error>
+	func listBlockedDevices() async -> Result<[String], Error>
+
+	// MARK: - Targeted transfers
+
+	func listPendingTargetedOffers() async -> Result<[PendingTargetedOfferModel], Error>
+	func respondToTargetedOffer(
+		transferId: String,
+		accepted: Bool
+	) async -> Result<TargetedOfferResponseModel, Error>
+	func createTargetedTransfer(
+		receiverEndpointId: String,
+		sources: [ShareSource],
+		transferName: String?
+	) async -> Result<TargetedTransferModel, Error>
+	func listTargetedTransfers() async -> Result<[TargetedTransferModel], Error>
+	/// Pulls an approved transfer into a security-scoped destination, holding
+	/// access for the duration of the stream (mirrors the invitation receive path).
+	func receiveTargetedTransfer(
+		transferId: String,
+		outputDirectoryUrl: String
+	) async -> Result<Void, Error>
+	/// Resumes an interrupted transfer. The same immutable transfer continues from
+	/// its verified progress and is not re-approved.
+	func resumeTargetedTransfer(
+		id: String,
+		outputDirectoryUrl: String
+	) async -> Result<Void, Error>
+	func cancelTargetedTransfer(id: String) async -> Result<Void, Error>
+	func deleteTargetedTransfer(id: String) async -> Result<Void, Error>
 }