feat(settings): settings app: apps list + per-capability allow/revoke, about (who/role), sign out; system-only caps permissions/session (install refused); pm MANAGE_BADGE copy (list/apps/allow/revoke only), APPS op; init WHO + session pass-on; factory decisions seeded for new system apps; k-ui list_item/toggle, screens/back/scroll

crates/manifest/src/capability.rs

@@ -59,6 +59,9 @@ catalog! {
     Sync = "sync",
     Accessibility = "accessibility",
     Print = "print",
+    // System-only (see `Capabilities::SYSTEM_ONLY`).
+    Permissions = "permissions",
+    Session = "session",
 }
 
 impl Capability {
@@ -73,6 +76,12 @@ pub struct Capabilities(u32);
 
 impl Capabilities {
     pub const NONE: Self = Self(0);
+    /// Only apps on the system image may hold these, pre-approved by
+    /// whoever built it; an app a user installs that asks for one is
+    /// refused, so no prompt can talk a user into handing them over.
+    /// `permissions`: changing what other apps may use. `session`: who is
+    /// signed in, and signing out.
+    pub const SYSTEM_ONLY: Self = Self(1 << Capability::Permissions as u32 | 1 << Capability::Session as u32);
 
     /// As sent in a message word.
     pub const fn bits(self) -> u32 {