feat(settings): settings app: apps list + per-capability allow/revoke, about (who/role), sign out; system-only caps permissions/session (install refused); pm MANAGE_BADGE copy (list/apps/allow/revoke only), APPS op; init WHO + session pass-on; factory decisions seeded for new system apps; k-ui list_item/toggle, screens/back/scroll

docs/apps.md

@@ -87,6 +87,13 @@ optional one is simply not granted.
 |---|---|
 | `display` | a window of its own, named from its manifest: its pixels, and the keyboard while it is in front |
 | `storage` | the user's `data/<id>/`, read-write (its own folder only) |
+| `permissions` | a management copy of the permission manager's endpoint (below) |
+| `session` | init's session copy: who is signed in (`WHO`), and signing out |
+
+`permissions` and `session` are **system only**: only an app on the system
+image (with a factory decision) has them. Installing an app that asks for
+either, required or optional, is refused (`SYSTEM_ONLY`). Settings
+(`kos.settings`) is the app that holds them.
 
 ## Decisions
 
@@ -100,7 +107,9 @@ granted = ["display"]
 Written by the permission manager when the user decides; apps on the
 system image ship with their decisions already recorded under
 `factory/permissions/` (pre-approved by whoever built the image), and init
-seeds them into each new user's `permissions/`. Changing one later is that
+seeds them into each new user's `permissions/`; a system app added to the
+image later is seeded into existing users' at their next sign-in (decisions
+already there are left alone). Changing one later is that
 user's call, through the permission manager.
 
 ## Permission manager
@@ -141,6 +150,14 @@ permission manager:
 5. Replies with a handle (the process capability, call-only) the launcher
    can wait on and kill.
 
+### Managing
+
+`APPS` lists every installed app, a line each: `id`, `name`, then the
+required, optional and granted capabilities as bit masks, tab separated.
+An app granted `permissions` gets a copy of the permission manager's
+endpoint badged `MANAGE_BADGE`: it may only `LIST`, `APPS`, `ALLOW` and
+`REVOKE`, never install or launch. The copy is revoked when the app dies.
+
 ### Revoke
 
 The user withdraws a capability: the decision changes and the next launch

docs/ipc.md

@@ -120,7 +120,10 @@ Signing out (`types::spawn::SIGN_OUT`, sent one way through the copy of
 init's endpoint the shell holds) stops everything the session ran (the
 shell, the permission manager, every app), locks storage (`LOCK`, init only: every grant
 taken back, every file closed, the key forgotten), removes a guest's
-files, and runs the gatekeeper again.
+files, and runs the gatekeeper again. `WHO` on the same copy answers the
+signed-in user's role (`types::spawn::role`: owner, standard, guest) and
+name (`types::name`, packed into the reply's words). The permission manager
+holds a copy it may only pass on, call-only, to an app granted `session`.
 
 Init restarts what dies (`init/src/supervise.rs`): every server, and the
 session's programs, except the gatekeeper and storage. A restarted server