feat(lock): detect Spotlight and launcher overlays for rules

Launcher overlays (Spotlight, Raycast, Alfred, LaunchBar) take keyboard
focus without changing NSWorkspace.frontmostApplication, so per-app
rules resolved against the app behind them: Spotlight could not be
locked to its own source, and an underlying CJKV lock leaked into the
search field (issue #9).

An Accessibility-gated FloatingAppMonitor now observes the known
launcher processes and reads the system-wide focused UI element to
attribute the real keyboard owner; the engine resolves rules against
that launcher when present and reverts on dismissal. The core lock
stays permission-free — without the grant, behavior is unchanged.

Accessibility now gates two optional features (per-URL enhanced mode
and launcher detection), so its single grant moved to a dedicated
Permissions tab; App Rules and URL Rules show a passive note that
routes there, never a prompt duplicated per feature. The grant
watcher's abandon-stop moved to the Settings window (not a tab switch)
and a status refresh now runs the full grant completion, so switching
tabs mid-grant or granting out-of-band no longer leaves the launcher
monitor unattached.

Signed-off-by: Kevin Cui <bh@bugs.cc>

Author: BlackHole1

Sources/LockIME/AppState.swift

@@ -77,6 +77,10 @@ final class AppState {
     /// User language choice, loaded eagerly so scenes get the right locale.
     private(set) var languagePreference: LanguagePreference = .system
 
+    /// The selected Settings tab. Held here (not as view `@State`) so a feature
+    /// pane can route the user to General's single Accessibility grant.
+    var settingsTab: SettingsTab = .general
+
     /// Master on/off, mirroring `config.isEnabled`.
     var isLocked: Bool { config.isEnabled }
 
@@ -324,8 +328,16 @@ final class AppState {
         commit()
     }
 
+    /// Reconcile the cached flag with the live trust state. This is the recovery
+    /// path: the user may grant while the polling watcher is stopped (e.g. after
+    /// closing the window mid-flow) or entirely out-of-band in System Settings,
+    /// so a refresh that observes a *new* grant must run the same completion the
+    /// watcher would have. Also flips the flag back on revoke.
     func refreshAccessibilityStatus() {
-        accessibilityGranted = AXIsProcessTrusted()
+        let trusted = AXIsProcessTrusted()
+        let newlyGranted = trusted && !accessibilityGranted
+        accessibilityGranted = trusted
+        if newlyGranted { handleAccessibilityGranted() }
     }
 
     /// Open System Settings with the floating drag helper, then start watching
@@ -351,8 +363,19 @@ final class AppState {
     /// Run when the grant is detected: close the floating helper (the system
     /// never does) and flip the flag so the toggle becomes usable at once.
     private func completeAccessibilityGrant() {
-        permissionFlow.closePanel(returnToPreviousApp: true)
         accessibilityGranted = true
+        handleAccessibilityGranted()
+    }
+
+    /// Run once when the grant is first observed — by the polling watcher *or* a
+    /// status refresh. Closes the floating helper (the system never does), stops
+    /// the now-finished watcher, and attaches the launcher-overlay monitor
+    /// (Spotlight, Raycast, …) which needs the grant to register its observers.
+    /// All three are idempotent, so observing the grant twice is harmless.
+    private func handleAccessibilityGranted() {
+        permissionFlow.closePanel(returnToPreviousApp: true)
+        accessibilityWatcher.stop()
+        engine?.accessibilityDidChange()
     }
 
     #if DEBUG