The redesign branch was cut before "Harden privileged command operands
against injection" landed on main; the rebase conflicts in users.rs,
power.rs, firewall.rs and capabilities/default.json were resolved to
keep the stricter side of each:
- users.rs: keep `chpasswd_input` / `valid_chpasswd_password` (validates
the *password* for `:` / newline, which the redesign's inline checks
missed) and `may_delete_user` (refuses root / the current user);
fold in the redesign's `--` argv separators and GECOS control-char
stripping on top.
- power.rs: keep `charge_threshold_write` (validates `which` ∈
{start,end} and clamps) + `util::run_with_stdin` for the tee pipe,
plus its test; take the redesign's brightness clamp.
- firewall.rs: keep the port-only `valid_firewall_rule` /
`valid_rule_number` allowlist from f7b114f. NOTE: the redesign's
Firewall UI hint advertises service names ("OpenSSH") which this
validator rejects — either loosen it to `util::valid_cli_value` or
drop the service-name hint. Left strict pending that call.
- capabilities/default.json: keep `opener:default` removed (nothing in
the frontend or backend uses the opener plugin); add the four
`core🪟*` perms the redesign's custom Titlebar needs.
Drops `util::valid_username` / `util::valid_cli_value` (added by the
redesign, now unused — every call site uses the stricter f7b114f local
validator) and the unused `use super::util` in firewall.rs.
Rework the settings app around hub pages (home, network, displays, input,
apps, privacy, system) with a redesigned sidebar, shared nav state, and new
hub view components. Alongside the redesign: validate webview inputs into
root commands (users, firewall, snapshots, wifi), fix set_charge_threshold
writing the percentage via tee stdin, prevent streaming installs from
hanging on inherited stdin, add frontend type fixes, sync versions to
0.8.2, and clean up clippy/svelte-check warnings.
