feat(settings): settings app: apps list + per-capability allow/revoke, about (who/role), sign out; system-only caps permissions/session (install refused); pm MANAGE_BADGE copy (list/apps/allow/revoke only), APPS op; init WHO + session pass-on; factory decisions seeded for new system apps; k-ui list_item/toggle, screens/back/scroll

crates/apps/shell/src/main.rs

@@ -133,6 +133,7 @@ fn refused(what: &str, r: Refused) {
         reply::BAD_MANIFEST if r.detail > 0 => println!("shell: {}: bad manifest, line {}", what, r.detail),
         reply::BAD_MANIFEST => println!("shell: {}: bad manifest", what),
         reply::NOT_REQUESTED => println!("shell: {}: never asked for that", what),
+        reply::SYSTEM_ONLY => println!("shell: {}: asks for {}, which only system apps may have", what, names(r.detail)),
         reply::BUSY => println!("shell: no room to run {}", what),
         _ => println!("shell: {}: failed", what),
     }