Browser pairing, notifications, element hiding; drop the top bar

Pairing decrypts a Chromium browser's cookie store (PBKDF2-HMAC-SHA1
against its Keychain key, then AES-128-CBC) and injects the result into
WKHTTPCookieStore. Only the configured apps' hosts and their sign-in
hosts survive the filter. Browsers are offered most-recently-used first,
since the first entry becomes the default and someone with four
Chromium browsers installed wants the one they actually browse in.

WKWebView defines window.Notification but it does nothing: constructing
one throws no error and shows no banner, so a page believes it notified
you. Measured on the machine as `api=function shim=no` before the shim
was made unconditional; `from page: Odoo - Test notification -> raised`
after.

Anything on a page can be right-clicked away. The rule is re-asserted on
every navigation, because the injected script only carries a snapshot
from when the view was built and a selector added since would otherwise
come back on reload.

The top bar is gone. Navigation lives beside the cog, the nav carries
the traffic lights, and two-finger swipe goes back and forward.

The seed is now the real app list, scoped to exact hosts so a Drive link
inside Gmail switches rather than being swallowed.

src-tauri/src/lib.rs

@@ -1,6 +1,7 @@
 pub mod commands;
 pub mod config;
 pub mod routing;
+pub mod cookies;
 pub mod webviews;
 
 use tauri::menu::{AboutMetadata, Menu, PredefinedMenuItem, Submenu};
@@ -50,9 +51,14 @@ pub fn run() {
     tauri::Builder::default()
         .menu(build_menu)
         .plugin(tauri_plugin_opener::init())
+        .plugin(tauri_plugin_notification::init())
         .setup(|app| {
             let state = commands::build_state(&app.handle().clone())?;
             app.manage(state);
+
+            // Asked for at startup rather than at the first notification, so
+            // the prompt does not arrive attached to someone else's message.
+            commands::ensure_notification_permission(&app.handle().clone());
             Ok(())
         })
         .invoke_handler(tauri::generate_handler![
@@ -75,6 +81,12 @@ pub fn run() {
             commands::delete_group,
             commands::set_nav_collapsed,
             commands::set_theme,
+            commands::set_hidden,
+            commands::pick_hidden,
+            commands::test_notification,
+            commands::notification_status,
+            commands::list_browsers,
+            commands::pair_browser,
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");