bos-settings 0.6.0: Power, Firewall, Users, AUR, Firmware panels

Continues reducing terminal-reliance for graphical system control. Five
new panels, plus three GUI apps shipped for things better served by an
existing dedicated tool than reimplemented in bos-settings
(gnome-disk-utility, gufw, mission-center).

- Power: battery status/health, brightness, charge-limit thresholds where
  the hardware exposes them, TLP profile shown read-only by design (no
  Balanced/Performance switcher — TLP auto-selects by power source, and
  power-profiles-daemon isn't installed because it conflicts with tlp).
- Firewall: ufw enable/disable, add/remove rules, view active rules.
  ufw's own status check requires root (confirmed against the installed
  script — not just changes, reads too), so unlike every other panel this
  one does NOT query state in build(): every view is constructed eagerly
  at app launch, and an unconditional privileged read here would mean a
  polkit prompt on every single bos-settings open. Starts blank with a
  "Status not loaded" placeholder; state loads only on an explicit Refresh
  click, with a guard so refresh's own set_active() doesn't loop back into
  triggering ufw enable/disable.
- Users: add/remove accounts, change passwords. All through pkexec on a
  background thread. Can't remove the account you're currently running as.
- AUR: search via yay. Installing deliberately opens a terminal instead of
  a silent --noconfirm install — yay's interactive PKGBUILD diff review and
  sudo prompt are the actual safety mechanism against a malicious AUR
  package, not a formality worth automating away.
- Firmware: fwupd device list + updates, same stream-output-then-refresh
  pattern as Packages.

packages.x86_64: gnome-disk-utility, gufw, mission-center for disk/firewall/
task-manager GUIs that don't need reinventing inside bos-settings.

iso/packages.x86_64

@@ -287,6 +287,15 @@ system-config-printer
 # remote post-install (needs network); the runtime is shipped ready.
 flatpak
 
+# Graphical alternatives to terminal-only tools, so users who want more
+# graphical control aren't funneled to a shell for everyday things.
+# gnome-disk-utility: partition/format/SMART-health GUI for gnome-disks.
+# gufw: GUI front-end for the ufw firewall bos already enables by default.
+# mission-center: graphical task manager (CPU/mem/disk/net + process list).
+gnome-disk-utility
+gufw
+mission-center
+
 # Firewall — ufw, enabled deny-incoming in post-install.sh (mDNS allowed so
 # printer discovery still works).
 ufw