feat(settings): settings app: apps list + per-capability allow/revoke, about (who/role), sign out; system-only caps permissions/session (install refused); pm MANAGE_BADGE copy (list/apps/allow/revoke only), APPS op; init WHO + session pass-on; factory decisions seeded for new system apps; k-ui list_item/toggle, screens/back/scroll

docs/ipc.md

@@ -120,7 +120,10 @@ Signing out (`types::spawn::SIGN_OUT`, sent one way through the copy of
 init's endpoint the shell holds) stops everything the session ran (the
 shell, the permission manager, every app), locks storage (`LOCK`, init only: every grant
 taken back, every file closed, the key forgotten), removes a guest's
-files, and runs the gatekeeper again.
+files, and runs the gatekeeper again. `WHO` on the same copy answers the
+signed-in user's role (`types::spawn::role`: owner, standard, guest) and
+name (`types::name`, packed into the reply's words). The permission manager
+holds a copy it may only pass on, call-only, to an app granted `session`.
 
 Init restarts what dies (`init/src/supervise.rs`): every server, and the
 session's programs, except the gatekeeper and storage. A restarted server