feat(apple): saved devices and targeted transfers UI

Adds the native SwiftUI Saved Devices experience on top of the production
saved-device core, as a top-level destination in the iOS tab bar and the
macOS sidebar.

Core seam:
- App-facing saved-device domain models mirroring core/SavedDeviceModels.kt,
  with lifecycle helpers (canReceive/canResume/canCancel/canDelete) so views
  never hand-roll state checks.
- 21 gateway methods through CoreGateway/CoreRepository with UniFFI mapping.
  cancelTargetedTransfer, forgetSavedDevice and blockDevice run off the serial
  lane: each must reach the core while a targeted receive is blocking it.
- Payload-free pairingChanged/targetedTransferChanged signals, dispatched
  before the numeric-transferId guard since saved-device events identify
  their subject by peer endpoint or a string transfer id.

Experience:
- Screen lists saved devices and outstanding consent requests only; the
  global targeted-transfer history stays out, reachable per device.
- Details as a sheet with detents on compact layouts and a native inspector
  on macOS, owning Send, label, forget/block and that device's transfers.
- Label editing is transactional: the draft and editor survive a failed
  write, conflicting actions are refused while saving, and the editor closes
  only after the core confirms.
- Pairing and targeted-offer consent hosted at the app root, answerable from
  any tab and suppressed while a transfer approval is up. Dismissing a
  pairing prompt suppresses locally without consuming the single-use
  eligibility; dismissing an offer declines it, since an unanswered offer
  holds a slot in the core's bounded per-sender queue.
- Targeted send reuses the invitation composer's affordances with file,
  folder, rename, replace and cleanup parity. Picker copies are released on
  replace/remove/clear/cancel and after a successful create, but kept after a
  failure so retry does not require re-picking.
- Notifications for pairing requests and offers (withdrawn once answered) and
  for terminal targeted transfers. Wording follows direction: on the sending
  device the peer finished receiving, not us.

Localization:
- Widens 52 saved-device keys from kmp-only to both platforms.
- Five keys carried a literal %1$s with no declared args, which Compose
  renders positionally but the Apple generator emits as a plain constant,
  leaking the placeholder into the UI. They now use named args; Compose
  output is byte-identical.
- Adds targeted_offer_title/body. Reusing the invitation approval copy stated
  the roles backwards, announcing the sender as the receiver.

Also surfaces core startup failures: the startup overlay is drawn above the
snackbar host, so a failed initialize() was indistinguishable from an app
that never finished loading. AppModel now keeps the reason, logs it, and the
overlay shows it with a retry, plus the technical detail in DEBUG builds.

Send and receive between two devices is verified only partially; a missing
endpoint-identity credential currently blocks startup on the test device.

apple/VniDrop/Features/SavedDevices/SavedDevicePresentation.swift

@@ -0,0 +1,75 @@
+import SwiftUI
+import SFSafeSymbols
+
+/// Shared presentation helpers for the saved-device surfaces.
+
+extension SavedDeviceModel {
+	/// `localLabel`, else the peer's untrusted display-name hint, else a generic
+	/// placeholder. Never falls back to the endpoint ID, which stays diagnostic.
+	var displayName: String {
+		displayNameOrNil ?? String(localized: L10n.Saved.devicesUnnamed)
+	}
+}
+
+extension TargetedTransferStateModel {
+	var label: String {
+		switch self {
+		case .preparing: return String(localized: L10n.Status.preparing)
+		case .offering: return String(localized: L10n.Status.offering)
+		case .awaitingApproval: return String(localized: L10n.Status.awaitingApproval)
+		case .approved: return String(localized: L10n.Status.approved)
+		case .connecting: return String(localized: L10n.Status.connecting)
+		case .transferring: return String(localized: L10n.Status.transferring)
+		case .interrupted: return String(localized: L10n.Status.interrupted)
+		case .completed: return String(localized: L10n.Status.completed)
+		case .declined: return String(localized: L10n.Status.declined)
+		case .cancelled: return String(localized: L10n.Status.cancelled)
+		case .failed: return String(localized: L10n.Status.failed)
+		// Deleted transfers are filtered out of the snapshot; label it defensively
+		// rather than crashing if one ever reaches the UI.
+		case .deleted: return String(localized: L10n.Status.cancelled)
+		}
+	}
+
+	var tone: PillTone {
+		switch self {
+		case .completed: return .success
+		case .failed, .declined: return .destructive
+		case .interrupted: return .warning
+		case .transferring, .connecting, .approved: return .brand
+		default: return .neutral
+		}
+	}
+}
+
+/// A device identity avatar. Deliberately generic: the core exposes no trustworthy
+/// hardware type, so showing a specific device silhouette would imply knowledge
+/// VniDrop does not have.
+struct DeviceAvatar: View {
+	var symbol: SFSymbol = .laptopcomputerAndIphone
+	var tint: Color = .secondary
+	var size: CGFloat = 40
+
+	var body: some View {
+		Image(systemSymbol: symbol)
+			.font(.system(size: size * 0.45))
+			.foregroundStyle(tint)
+			.frame(width: size, height: size)
+			.background(.quaternary, in: RoundedRectangle(cornerRadius: size * 0.225))
+	}
+}
+
+/// The endpoint ID, shown as secondary diagnostic detail. Truncated in the middle
+/// so both ends stay recognizable, and never used as a device's name.
+struct EndpointIdLabel: View {
+	let endpointId: String
+
+	var body: some View {
+		Text(L10n.Saved.devicesEndpoint(deviceId: endpointId))
+			.font(.caption2)
+			.foregroundStyle(.tertiary)
+			.lineLimit(1)
+			.truncationMode(.middle)
+			.textSelection(.enabled)
+	}
+}